CVE-2026-14560
The teddy‑bear‑customize‑addon WordPress plugin up to version 1.0.5 fails to validate uploaded files, allowing attackers to upload arbitrary PHP files. This flaw lets unauthenticated users run code on the server. The vulnerability is rated critical.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites that have the teddy‑bear‑customize‑addon plugin installed at version 1.0.5 or earlier.
Real-world impact
An attacker can upload malicious PHP files and execute them, giving full control over the web server, enabling data theft, site defacement, or further attacks.
Why this severity
The CVSS score of 10 reflects that the flaw is network‑exploitable, requires no privileges or user interaction, and provides attackers with complete compromise of confidentiality, integrity, and availability.
What to do about it
- ›Disable or uninstall the teddy‑bear‑customize‑addon plugin until a patch is released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description