CVE-2026-84171: WP Images Upload on Piclect RCE Vulnerability

CVE-2026-84171 Overview

CVE-2026-84171 is an unrestricted file upload vulnerability in the WP Images Upload on Piclect WordPress plugin through version 1.0. The plugin fails to validate the name or type of uploaded files before writing them to a publicly accessible directory. Unauthenticated attackers can upload arbitrary files, including PHP scripts, and execute arbitrary code on the server. The vulnerability is classified under [CWE-434] (Unrestricted Upload of File with Dangerous Type). The flaw is remotely exploitable over the network without user interaction or authentication.

Critical Impact
Unauthenticated attackers can upload arbitrary files to affected WordPress sites and achieve remote code execution, leading to full site compromise.

Affected Products

WP Images Upload on Piclect WordPress plugin, all versions through 1.0

Discovery Timeline

2026-09-12 - CVE-2026-84171 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-84171

Vulnerability Analysis

The WP Images Upload on Piclect plugin exposes a file upload endpoint that accepts arbitrary content. The plugin writes received files directly to a web-accessible directory within the WordPress installation. Because filenames and MIME types are not validated, an attacker can supply a .php file and request it via HTTP to trigger server-side execution.

This is a textbook [CWE-434] Unrestricted Upload of File with Dangerous Type flaw. The absence of authentication requirements makes exploitation trivial for any attacker who can reach the WordPress site over the network. Successful exploitation yields code execution under the web server user context, enabling webshell deployment, database access, credential theft, and lateral movement into hosting infrastructure.

The EPSS probability is 0.373% as of 2026-09-20, though public plugin vulnerabilities of this class are routinely weaponized by automated scanners targeting WordPress installations.

Root Cause

The root cause is the absence of two controls in the upload handler: file extension and MIME type validation, and authentication or capability checks. The plugin trusts client-supplied input for both the file name and file type. It writes uploaded content directly into a directory served by the web server without renaming, sanitization, or execution restrictions.

Attack Vector

An unauthenticated attacker sends an HTTP POST request to the plugin's upload endpoint carrying a malicious PHP file. The server writes the file to a public directory such as /wp-content/uploads/. The attacker then requests the uploaded file directly through the browser, causing the PHP interpreter to execute the payload. From that point, the attacker controls the site.

See the WPScan Vulnerability Description for additional technical detail.

Detection Methods for CVE-2026-84171

Indicators of Compromise

Unexpected .php, .phtml, .phar, or .htaccess files present in wp-content/uploads/ or plugin-managed directories
HTTP POST requests to WP Images Upload on Piclect plugin endpoints from unauthenticated sources
Web server access logs showing GET requests to newly created files in upload directories, followed by outbound network activity
New WordPress administrator accounts or modified wp-config.php timestamps following suspicious upload activity

Detection Strategies

Inventory WordPress installations for the WP Images Upload on Piclect plugin at version 1.0 or earlier
Alert on file creation events where executable file extensions appear within wp-content/uploads/ subdirectories
Correlate web server POST requests to plugin endpoints with subsequent GET requests to newly created files
Deploy web application firewall rules that inspect multipart uploads for PHP tags, shell interpreter references, or double-extension patterns

Monitoring Recommendations

Enable file integrity monitoring across the WordPress document root, with particular focus on wp-content/uploads/
Forward web server access logs and PHP error logs to a centralized SIEM for correlation and retention
Monitor outbound network connections initiated by the web server process for reverse shell indicators
Track process creation events under the web server user account for shell utilities such as sh, bash, nc, or curl

How to Mitigate CVE-2026-84171

Immediate Actions Required

Deactivate and remove the WP Images Upload on Piclect plugin from all WordPress installations until a patched version is released
Audit the wp-content/uploads/ directory tree for unauthorized files, particularly scripts with executable extensions
Rotate WordPress administrator credentials, API keys, and database passwords if compromise indicators are present
Review web server access logs for the plugin's upload endpoint dating back to plugin installation

Patch Information

No patched version has been identified in the enriched data. The vulnerability affects the plugin through version 1.0. Consult the WPScan Vulnerability Description for updates on remediation status. Until a fix is published, removal is the recommended course of action.

Workarounds

Remove the plugin entirely rather than relying on configuration workarounds
Configure the web server to deny PHP execution within wp-content/uploads/ using directives such as php_flag engine off in an .htaccess file or an equivalent Nginx location block
Restrict access to the plugin's upload endpoint using a web application firewall or IP allowlist
Enforce least-privilege file system permissions so the web server user cannot write executable files to publicly served directories

bash

# Apache: block PHP execution in the uploads directory
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (add to server block)
# location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
#     deny all;
#     return 403;
# }