CVE-2026-84738: AF Companion WordPress RCE Vulnerability

CVE-2026-84738 Overview

CVE-2026-84738 is an arbitrary file upload vulnerability in the AF Companion WordPress plugin before version 2.2.0. The plugin fails to validate the type of files uploaded through one of its import features. Users with the low-privileged store-management role can upload arbitrary files, including PHP scripts, leading to Remote Code Execution (RCE) on the underlying web server.

The flaw is classified under [CWE-94] Improper Control of Generation of Code. Because store-manager accounts are commonly provisioned in e-commerce deployments, the effective attack surface is broader than a typical administrator-only issue.

Critical Impact
An authenticated store-management user can upload a PHP web shell through the plugin's import feature and execute arbitrary code in the WordPress process context.

Affected Products

AF Companion WordPress plugin versions prior to 2.2.0
WordPress sites where the plugin is installed and activated
WordPress installations that assign store-management roles to non-administrative users

Discovery Timeline

2026-09-18 - CVE-2026-84738 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-84738

Vulnerability Analysis

The AF Companion plugin exposes an import feature intended for bulk data loading. The handler accepts uploaded files but does not enforce a server-side allowlist on file type, extension, or MIME. As a result, an attacker can submit a file with a .php extension and have it written into a web-accessible directory.

Once written, the attacker requests the file directly through the web server. The PHP interpreter executes the uploaded content, giving the attacker code execution as the web server user. From that position, attackers can read database credentials from wp-config.php, exfiltrate customer data, pivot to other tenants, or deploy persistent backdoors.

The vulnerability requires an authenticated session with the store-management role. In deployments where store managers are external staff, contractors, or self-registered vendors, the effective barrier to exploitation is low.

Root Cause

The root cause is missing input validation in the import upload handler. The plugin trusts the file supplied by the requester without verifying extension against an allowlist, without checking MIME type against expected import formats, and without renaming or sandboxing the stored file. This maps to [CWE-94], as attacker-controlled content is later interpreted as code by the PHP runtime.

Attack Vector

Exploitation follows a standard unrestricted-upload-to-RCE chain. The attacker authenticates to WordPress using a store-management account. They invoke the vulnerable import endpoint and submit a PHP payload disguised as an import file. The server writes the payload to a public upload path. The attacker then requests the file over HTTP to trigger execution. See the WPScan Vulnerability Advisory for advisory-level technical details.

Detection Methods for CVE-2026-84738

Indicators of Compromise

New .php, .phtml, or .phar files under wp-content/uploads/ or plugin-specific import directories with recent timestamps
POST requests to AF Companion import endpoints originating from store-management accounts followed by GET requests to newly created files in upload paths
Outbound network connections initiated by the php-fpm or web server process to unfamiliar hosts shortly after an import request
Unexpected modifications to wp-config.php, .htaccess, or theme files following an import action

Detection Strategies

Alert on any file with executable script extensions written into WordPress upload directories, regardless of upload source
Correlate authentication events for store-management roles with import endpoint access and subsequent direct requests to files under wp-content/uploads/
Deploy web server rules that inspect multipart uploads for PHP tags such as <?php or <?= in files submitted to import handlers

Monitoring Recommendations

Enable WordPress audit logging for role-based actions, file uploads, and plugin activity
Monitor process creation from web server users, including spawns of sh, bash, python, or curl
Track EPSS movement for CVE-2026-84738 and prioritize patching if exploitation activity rises

How to Mitigate CVE-2026-84738

Immediate Actions Required

Upgrade the AF Companion plugin to version 2.2.0 or later on all WordPress instances
Audit user accounts with the store-management role and revoke access for accounts that are unused, external, or over-provisioned
Inspect wp-content/uploads/ and plugin import directories for unauthorized .php, .phtml, or .phar files
Rotate WordPress administrator credentials, database credentials in wp-config.php, and any API keys stored on the host if compromise is suspected

Patch Information

The vendor addressed the vulnerability in AF Companion version 2.2.0 by adding file type validation to the import feature. Refer to the WPScan Vulnerability Advisory for the coordinated advisory and remediation details.

Workarounds

Temporarily deactivate the AF Companion plugin until it can be updated to 2.2.0 or later
Restrict the store-management role to trusted internal users only and remove import capability from non-administrative roles where possible
Configure the web server to deny PHP execution within wp-content/uploads/ using directory-scoped handler rules
Deploy a web application firewall (WAF) rule that blocks multipart uploads containing PHP tags to WordPress admin endpoints

bash

# Example Apache configuration to block PHP execution in uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9]?)$">
        Require all denied
    </FilesMatch>
    php_admin_flag engine off
</Directory>