CVE-2026-81090: Gpx2Graphics WordPress Plugin RCE Vulnerability

CVE-2026-81090 Overview

CVE-2026-81090 affects the Gpx2Graphics WordPress plugin through version 0.3. The plugin fails to perform a Cross-Site Request Forgery (CSRF) check when handling file uploads and does not validate the type of the uploaded file. An attacker can craft a malicious page that, when visited by an authenticated administrator, causes the browser to upload arbitrary files such as PHP scripts to the server. The uploaded file can then be executed, resulting in Remote Code Execution (RCE) on the WordPress host.

Critical Impact
A single visit by a logged-in administrator to an attacker-controlled page can result in full compromise of the WordPress site through arbitrary PHP file upload and execution.

Affected Products

Gpx2Graphics WordPress plugin, all versions through 0.3
WordPress sites with an authenticated administrator session active
Web servers hosting the vulnerable plugin with PHP execution enabled in the upload directory

Discovery Timeline

2026-09-12 - CVE-2026-81090 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-81090

Vulnerability Analysis

The vulnerability is a classic combination of two weaknesses: missing CSRF protection [CWE-352] and missing file type validation. The plugin exposes a file upload handler that trusts requests originating from an authenticated administrator session. Because no nonce or origin check is performed, the request can be triggered by any third-party origin as long as the target user is logged in.

Compounding the CSRF flaw, the handler accepts any file extension without validation. An attacker can therefore upload a .php file that is directly reachable via the plugin's upload directory. Requesting that file causes the PHP interpreter to execute the attacker's code under the web server user, yielding full application-level compromise.

Root Cause

The root cause is the absence of a WordPress nonce verification (for example, a missing check_admin_referer() or wp_verify_nonce() call) on the upload endpoint. Server-side file type restrictions and MIME validation are also absent, so no compensating control prevents PHP files from being written to a web-accessible location.

Attack Vector

Exploitation requires a logged-in administrator to visit a page controlled by the attacker. That page contains an HTML form or JavaScript that submits a multipart POST request to the vulnerable upload endpoint of the target WordPress site. The browser attaches the administrator's session cookies automatically. The server accepts the request, writes the PHP payload to the uploads directory, and the attacker then issues a GET request to the uploaded file to execute arbitrary commands.

No verified public exploit code is available. See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-81090

Indicators of Compromise

Unexpected .php, .phtml, or .phar files appearing in the Gpx2Graphics plugin upload directory under wp-content/
POST requests to Gpx2Graphics upload endpoints with Referer headers pointing to external, untrusted domains
Outbound network connections from the PHP-FPM or web server process to unknown hosts shortly after an upload event
New administrator accounts, modified wp-config.php, or unexpected scheduled tasks created after a suspicious upload

Detection Strategies

Alert on write operations that create files with executable script extensions inside wp-content/uploads/ or plugin-specific upload paths
Correlate HTTP POST requests to plugin upload handlers with subsequent GET requests to the same file path from the same or related client
Monitor web server logs for multipart/form-data uploads that lack a valid same-origin Referer or Origin header

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root, with priority on wp-content/uploads/ and all plugin directories
Ship web server access logs and PHP error logs to a central platform for correlation of upload and execution events
Track process creation from web server users to identify shell spawns, curl, wget, or interpreter invocations that follow an upload

How to Mitigate CVE-2026-81090

Immediate Actions Required

Deactivate and remove the Gpx2Graphics plugin from all WordPress installations until a patched version is confirmed available
Audit wp-content/uploads/ and plugin directories for unauthorized PHP files and remove any that are found
Rotate all administrator credentials and WordPress secret keys in wp-config.php if compromise is suspected
Review WordPress user tables for unauthorized administrator accounts created after the plugin was installed

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. The plugin is vulnerable through version 0.3. Consult the WPScan Vulnerability Report for the current remediation status before reinstalling.

Workarounds

Remove the plugin entirely if no fixed version is available
Deny PHP execution in the WordPress uploads directory using web server configuration
Require administrators to use a dedicated browser profile for WordPress administration to reduce CSRF exposure from general browsing
Deploy a web application firewall rule that blocks multipart uploads to plugin endpoints when the Origin or Referer header is missing or off-site

bash

# Apache: deny PHP execution in the WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>

# Nginx equivalent, place in the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}