MVIEW · CVE-2026-115212 · Package
NO FIX YET · SEE WHAT TO DO
The mView 豆瓣电影 WordPress plugin up to version 1.0.3 saves remotely fetched files into a web-accessible directory without checking their type, name, source, or the user's permissions. An authenticated user with the lowest WordPress role, such as subscriber, can upload a PHP file and run it on the server.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the mView 豆瓣电影 WordPress plugin at version 1.0.3 or earlier are exposed. Any account that can log in, including subscriber accounts, is enough to trigger the flaw, so sites with open registration carry the most risk. Sites without this plugin are not affected.
Not affected if no-user-accounts, plugin-above-1.0.3, plugin-not-installed
Who cares php, self-hosted, wordpress, wordpress-plugin
1.0.3 or earlier is affected1.0.3 is the latest release and the plugin is closed on WordPress.org (since 2026-10-23, pending review)The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.