CVE-2026-6101: AMP for WP Plugin RCE Vulnerability

CVE-2026-6101 Overview

CVE-2026-6101 is an arbitrary file write vulnerability in the AMP for WP – Accelerated Mobile Pages plugin for WordPress. The flaw affects all versions up to and including 1.1.12. It resides in the ampforwp_save_local_font() function, which performs unsafe ZIP file extraction and fails to clean up nested directories and files. Authenticated attackers with Author-level access or higher, granted permissions by an Administrator, can write arbitrary files to web-accessible locations. On hosts that execute PHP files from the uploads directory, this behavior can escalate to remote code execution. The vulnerability maps to [CWE-73: External Control of File Name or Path].

Critical Impact
Authenticated attackers can write arbitrary files to web-accessible paths, potentially achieving remote code execution on affected WordPress installations.

Affected Products

AMP for WP – Accelerated Mobile Pages plugin for WordPress
All versions up to and including 1.1.12
WordPress sites permitting Author-level or higher accounts with plugin access

Discovery Timeline

2026-07-07 - CVE-2026-6101 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-6101

Vulnerability Analysis

The vulnerability originates in the ampforwp_save_local_font() function, which handles ZIP archive extraction for local font uploads. The function does not validate archive entry paths or restrict destination directories. Attackers can craft ZIP files containing arbitrary filenames, including PHP source files, that extract into locations accessible from the web. The plugin's cleanup routine compounds the problem by failing to recursively remove nested directories and files created during extraction. Malicious payloads therefore persist on disk after the upload workflow completes. On WordPress hosts that permit PHP execution within the wp-content/uploads directory, written PHP files can be invoked directly through HTTP requests, yielding remote code execution under the web server user.

Root Cause

The root cause is unsafe ZIP extraction combined with inadequate post-extraction cleanup [CWE-73]. The plugin trusts entry names inside uploaded archives and does not enforce a canonical extraction path. No validation prevents attacker-controlled filenames or file extensions from being written to the filesystem.

Attack Vector

Exploitation requires an authenticated session with at least Author-level privileges and an Administrator-granted permission set that exposes the vulnerable font upload functionality. An attacker crafts a ZIP archive containing a PHP payload, submits it through the AMP for WP local font handler, and then requests the extracted file directly. High attack complexity reflects the privilege prerequisite and the need for a host configuration that executes PHP within the uploads path. See the Wordfence Vulnerability Report and the WordPress Plugin Code Snippet for technical references.

// No verified exploit code available.
// The exploitation flow abuses ampforwp_save_local_font() by
// submitting a ZIP archive containing PHP files that extract
// into a web-accessible directory without path validation.

Detection Methods for CVE-2026-6101

Indicators of Compromise

Unexpected PHP files present in wp-content/uploads/ and subdirectories under the AMP for WP plugin's font upload paths.
ZIP archives uploaded through the plugin containing entries with .php, .phtml, or double-extension filenames.
Web server access logs showing direct GET or POST requests to newly created files under the uploads path.

Detection Strategies

Audit WordPress user roles for Author-level and higher accounts with plugin capability grants and correlate with recent font upload activity.
Inspect the extraction targets of ampforwp_save_local_font() for filenames that do not match legitimate font file types such as .ttf, .woff, or .woff2.
Baseline the AMP for WP uploads directory and alert on new files with executable extensions or unexpected directory nesting.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress wp-content/uploads tree and flag creation of PHP files.
Forward WordPress and web server logs to a centralized analytics platform for correlation of upload events with subsequent HTTP execution requests.
Monitor administrator changes that grant Author accounts additional plugin-related capabilities.

How to Mitigate CVE-2026-6101

Immediate Actions Required

Update the AMP for WP – Accelerated Mobile Pages plugin to the version published in WordPress Changeset #3512870, which supersedes 1.1.12.
Review Administrator-granted capabilities and revoke plugin permissions from Author-level accounts that do not require them.
Scan the uploads directory for unauthorized PHP files and remove any that are not part of legitimate plugin assets.

Patch Information

The vendor addressed the flaw in the plugin repository via WordPress Changeset #3512870. Site operators should upgrade to the fixed release published after version 1.1.12. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Disable the AMP for WP plugin until the patched version is installed.
Configure the web server to deny PHP execution within wp-content/uploads using directives such as php_flag engine off in Apache or a location block in nginx.
Restrict Author-level and above accounts from accessing the local font upload functionality by removing the associated capabilities.

bash

# Apache: block PHP execution inside the WordPress uploads directory
# Place this file at wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

# nginx equivalent: add to the server block
# location ~* /wp-content/uploads/.*\.php$ { deny all; return 403; }