CVE-2026-84171
The piclect WordPress plugin version 1.0 lets anyone upload files without checking their type or name, allowing attackers to place malicious files on the server. This can lead to arbitrary code execution and full compromise of the site. The vulnerability is rated critical.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites that use the piclect plugin, version 1.0.
Real-world impact
An attacker can upload a malicious file—such as a PHP script—to the server and execute it, giving them full control over the site’s data, configuration, and availability.
Why this severity
The CVSS score of 9.8 reflects that the flaw is network‑reachable, requires no authentication, and provides attackers with complete confidentiality, integrity, and availability compromise.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources