CVE-2026-75799: YAHMAN Add-ons WordPress RCE Vulnerability

CVE-2026-75799 Overview

CVE-2026-75799 affects the YAHMAN Add-ons plugin for WordPress in versions prior to 0.9.31. The plugin caches remote files in a publicly accessible directory without validating file type. Unauthenticated attackers can write arbitrary PHP files to the web server and trigger remote code execution when the affected feature is enabled. The flaw maps to CWE-94: Improper Control of Generation of Code. Details were published in a WPScan Vulnerability Report.

Critical Impact
Unauthenticated attackers can plant PHP files in a web-accessible directory and execute arbitrary code on the WordPress host, leading to full site compromise.

Affected Products

YAHMAN Add-ons WordPress plugin versions before 0.9.31
WordPress installations with the remote file caching feature enabled
Any hosting environment serving the plugin's cache directory over HTTP

Discovery Timeline

2026-09-23 - CVE-2026-75799 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-75799

Vulnerability Analysis

The YAHMAN Add-ons plugin includes a feature that fetches remote files and caches them locally to improve performance. The caching routine writes retrieved content to a directory that is reachable through the web server. The routine does not verify the file's MIME type, extension, or content before writing it to disk.

An attacker supplies a URL pointing to a PHP payload. The plugin downloads the payload and stores it in the public cache directory. Because the destination remains executable by the PHP interpreter, the attacker triggers execution by requesting the cached file directly. This behavior classifies the issue as Remote Code Execution (RCE) driven by improper code generation controls under [CWE-94].

Exploitation requires the caching feature to be enabled. The WPScan advisory documents the affected code path and version range.

Root Cause

The plugin trusts the file returned by the remote URL. It writes bytes to disk without allow-listing file extensions, checking MIME types, or stripping executable content. The cache directory also lacks execution restrictions, allowing the web server to interpret written .php files.

Attack Vector

The attack occurs over the network without authentication. An unauthenticated attacker submits a request that instructs the plugin to cache a remote resource under attacker control. The remote resource contains PHP code. After the write completes, the attacker requests the cached file, and the server executes the payload with the privileges of the PHP worker process.

No verified public exploit code is available at publication time. Refer to the WPScan Vulnerability Report for indicators tied to the vulnerable code path.

Detection Methods for CVE-2026-75799

Indicators of Compromise

Unexpected .php, .phtml, or .phar files inside the YAHMAN Add-ons cache directory under wp-content/.
Web server access logs showing external URLs passed as parameters to plugin endpoints followed by direct requests to files inside the cache path.
New WordPress admin users, modified wp-config.php, or webshell-like output returned from cache URLs.

Detection Strategies

Monitor filesystem writes to wp-content subdirectories owned by the plugin for files with executable extensions.
Inspect HTTP request bodies and query strings for remote URLs supplied to YAHMAN Add-ons handlers.
Correlate outbound HTTP fetches by the PHP process with subsequent inbound requests to the cache directory.

Monitoring Recommendations

Enable WordPress audit logging for plugin activity and file changes under wp-content/.
Forward web server and PHP error logs to a centralized SIEM for query-based hunting.
Alert on process execution chains where php-fpm or httpd spawns shells such as /bin/sh, bash, or python.

How to Mitigate CVE-2026-75799

Immediate Actions Required

Update the YAHMAN Add-ons plugin to version 0.9.31 or later on all WordPress sites.
Disable the remote file caching feature until the patched version is deployed.
Audit the plugin's cache directory and remove any unexpected files, especially those with executable extensions.

Patch Information

The vendor addressed the issue in YAHMAN Add-ons version 0.9.31. The fix validates remote file types before writing them to the cache directory. Consult the WPScan Vulnerability Report for the authoritative patch reference.

Workarounds

Deny PHP execution within the plugin's cache directory using web server configuration.
Restrict outbound HTTP requests from the web server to a defined allow-list of hosts.
Place the site behind a WAF rule that blocks arbitrary remote URL parameters targeting the plugin's endpoints.

bash

# Apache: block PHP execution in the plugin cache directory
<Directory "/var/www/html/wp-content/uploads/yahman-cache">
    php_flag engine off
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx: equivalent restriction
location ~* /wp-content/uploads/yahman-cache/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}