CVE-2026-66627: GP Premium Auth Bypass Vulnerability

CVE-2026-66627 Overview

CVE-2026-66627 is an arbitrary file upload vulnerability in the GP Premium WordPress plugin affecting versions 2.5.5 and earlier. The flaw allows authenticated users holding the Contributor role to upload files of unrestricted type through the plugin. Successful exploitation lets attackers place executable content on the web server and achieve remote code execution within the WordPress process context. The issue is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
A low-privileged Contributor account can upload arbitrary files, leading to remote code execution, full site takeover, and lateral movement into the underlying host.

Affected Products

GP Premium plugin for WordPress, versions <= 2.5.5
WordPress sites where Contributor-level registration or accounts exist
Any environment running GP Premium alongside the GeneratePress theme stack

Discovery Timeline

2026-08-18 - CVE-2026-66627 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-66627

Vulnerability Analysis

The vulnerability stems from missing validation on file uploads exposed by GP Premium. The plugin accepts uploads from authenticated Contributor sessions without enforcing an allow-list of safe MIME types or file extensions. Attackers submit PHP, phtml, or other executable payloads that WordPress then stores under the site's wp-content/uploads/ directory tree.

Once written to disk, the payload is retrievable through the standard uploads URL and executed by the PHP handler. This transforms a low-privileged content contributor into an attacker with code execution on the web server. The scope change reflected in the CVSS vector aligns with the impact on the wider host after webshell deployment.

The flaw combines two failure modes tracked under CWE-434: improper input validation on the upload endpoint and reliance on client-supplied metadata to determine file safety. Consult the Patchstack advisory for vendor references.

Root Cause

GP Premium's upload handler does not sanitize the uploaded filename, extension, or content type before persisting the file. WordPress role checks for the Contributor capability set are treated as sufficient authorization, but Contributors are not intended to publish executable server-side content.

Attack Vector

An attacker with a Contributor account authenticates to WordPress and sends a crafted multipart/form-data POST request to the plugin's upload endpoint. The request references a PHP payload with a bypass extension or manipulated MIME header. The server writes the file to a publicly reachable path, and the attacker triggers execution by requesting the resulting URL.

No verified proof-of-concept code is published at this time. Refer to the Patchstack advisory for further technical detail.

Detection Methods for CVE-2026-66627

Indicators of Compromise

New .php, .phtml, .phar, or double-extension files appearing under wp-content/uploads/ after a Contributor login event.
Outbound connections from the web server to attacker-controlled hosts shortly after file upload activity.
Unexpected WordPress users, plugin installations, or option-table modifications made by the www-data process.

Detection Strategies

Inspect web-server access logs for POST requests to GP Premium upload endpoints followed by GET requests to newly created files under /wp-content/uploads/.
Alert on file-write events by the PHP-FPM or Apache user that create files with executable extensions inside the uploads directory.
Correlate WordPress audit logs showing Contributor authentication with subsequent process execution originating from the web root.

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and adjacent WordPress directories.
Forward WordPress, PHP, and reverse-proxy logs to a centralized SIEM for retention and correlation.
Track creation of new administrator accounts and plugin installs as high-severity events.

How to Mitigate CVE-2026-66627

Immediate Actions Required

Update GP Premium to a version later than 2.5.5 as soon as the vendor releases a fixed build.
Audit existing Contributor accounts, disable any that are unused, and reset credentials on active ones.
Scan wp-content/uploads/ for executable files and remove any that are unauthorized.
Restrict PHP execution inside upload directories at the web-server configuration layer.

Patch Information

Refer to the Patchstack advisory for the fixed version and vendor guidance. Apply the update through the WordPress plugin manager or the vendor's licensed download portal.

Workarounds

Temporarily disable the GP Premium plugin until the update can be applied.
Deny PHP execution in wp-content/uploads/ using Apache .htaccess or an Nginx location block.
Remove the upload_files capability from the Contributor role using a capability-management plugin.
Place the site behind a web application firewall configured to block executable file uploads.

bash

# Nginx: block PHP execution inside the WordPress uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}