{"id":"CVE-2026-115212","kind":"vulnerability","aliases":["CVE-2026-115212"],"related":[],"title":"WordPress mView plugin: any logged-in user can upload PHP and run code","description":"The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution.","summary":"The mView 豆瓣电影 WordPress plugin up to version 1.0.3 saves remotely fetched files into a web-accessible directory without checking their type, name, source, or the user's permissions. An authenticated user with the lowest WordPress role, such as subscriber, can upload a PHP file and run it on the server.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mview","fixed":[],"affected":"<= 1.0.3","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","php","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-user-accounts","plugin-above-1.0.3","plugin-not-installed"],"how_to_check":"In WP admin > Plugins, or run: wp plugin list | grep mview. Any installed mView 豆瓣电影 (slug mview) at 1.0.3 or earlier is affected. Also check wp-content/uploads and the plugin directory for unexpected .php files.","fix":"No patched version: 1.0.3 is the latest release and the plugin is closed on WordPress.org (since 2026-10-23, pending review). Remove the plugin.","status":"open","published_at":"2026-11-09T07:17:27+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:52+00:00","updated_at":"2026-11-09T07:26:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T07:25:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress mView plugin: any logged-in user can upload PHP and run code","impact":"high","summary":"The mView 豆瓣电影 WordPress plugin up to version 1.0.3 saves remotely fetched files into a web-accessible directory without checking their type, name, source, or the user's permissions. An authenticated user with the lowest WordPress role, such as subscriber, can upload a PHP file and run it on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","php","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary PHP code on the web server","analyst_note":"No fixed version or check is stated in the sources; confirm the vendor or WordPress.org plugin page for a patched release and check whether the plugin is still maintained.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-1.0.3","no-user-accounts"],"who_is_affected":"Sites running the mView 豆瓣电影 WordPress plugin at version 1.0.3 or earlier are exposed. Any account that can log in, including subscriber accounts, is enough to trigger the flaw, so sites with open registration carry the most risk. Sites without this plugin are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000724,"input_tokens":4568,"output_tokens":535,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"No fixed version or check is stated in the sources; confirm the vendor or WordPress.org plugin page for a patched release and check whether the plugin is still maintained.","search":"'-115212':17A,20A '-2026':16A,19A '1.0.3':39B,89C 'access':48B,117C 'achiev':133C 'allow':119C 'arbitrari':129C 'authent':62B,121C 'author':108C 'capabl':106C 'check':51B,109C 'code':14A,135C 'cve':15A,18A 'directori':49B,118C 'execut':136C 'fetch':42B,101C 'file':43B,76B,102C,131C 'host':26B 'log':6A 'logged-in':5A 'lowest':66B 'mview':2A,21A,32B,84C 'name':54B,95C 'packag':22B 'perform':104C 'permiss':60B 'php':11A,23B,75B,130C 'plugin':3A,30B,35B,87C 'remot':41B,100C,134C 'role':68B 'run':13A,78B 'save':40B,111C 'self':25B 'self-host':24B 'server':82B 'sourc':55B,97C 'subscrib':71B,126C 'type':53B,94C 'upload':10A,73B,128C 'user':8A,58B,63B,122C 'valid':92C 'version':38B 'web':47B,116C 'web-access':46B,115C 'without':50B 'wordpress':1A,27B,29B,34B,67B,86C 'wordpress-plugin':28B '豆瓣电影':33B,85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the mView 豆瓣电影 WordPress plugin at version 1.0.3 or earlier are exposed. Any account that can log in, including subscriber accounts, is enough to trigger the flaw, so sites with open registration carry the most risk. Sites without this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["mview"],"ptokens":["mview"],"labels":["critical","package","php","selfhosted","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-115212':17A,20A '-2026':16A,19A 'code':14A 'cve':15A,18A 'log':6A 'logged-in':5A 'mview':2A,21A 'php':11A 'plugin':3A 'run':13A 'upload':10A 'user':8A 'wordpress':1A","search_b":"'1.0.3':39B 'access':48B 'authent':62B 'check':51B 'directori':49B 'fetch':42B 'file':43B,76B 'host':26B 'lowest':66B 'mview':32B 'name':54B 'packag':22B 'permiss':60B 'php':23B,75B 'plugin':30B,35B 'remot':41B 'role':68B 'run':78B 'save':40B 'self':25B 'self-host':24B 'server':82B 'sourc':55B 'subscrib':71B 'type':53B 'upload':73B 'user':58B,63B 'version':38B 'web':47B 'web-access':46B 'without':50B 'wordpress':27B,29B,34B,67B 'wordpress-plugin':28B '豆瓣电影':33B","search_c":"'1.0.3':89C 'access':117C 'achiev':133C 'allow':119C 'arbitrari':129C 'authent':121C 'author':108C 'capabl':106C 'check':109C 'code':135C 'directori':118C 'execut':136C 'fetch':101C 'file':102C,131C 'mview':84C 'name':95C 'perform':104C 'php':130C 'plugin':87C 'remot':100C,134C 'save':111C 'sourc':97C 'subscrib':126C 'type':94C 'upload':128C 'user':122C 'valid':92C 'web':116C 'web-access':115C 'wordpress':86C '豆瓣电影':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115212","severity":null,"published_at":"2026-11-09T07:17:27+00:00","modified_at":"2026-11-09T07:17:27+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115212:2253","url":"https://wordpress.org/plugins/mview/","severity":null,"published_at":"2026-11-09T07:26:27+00:00","modified_at":"2026-11-09T07:26:27+00:00","first_seen_at":"2026-11-09T07:26:27+00:00","fetched_at":"2026-11-09T07:26:27+00:00","note":"NVD text only; WordPress.org page shows plugin closed 2026-10-23, latest 1.0.3, no fix. web-cli (Exa) out of credits, X not checked. NVD page not readable via WebFetch. Nothing verified: the plugin page does not mention the vulnerability.","cites":["https://wordpress.org/plugins/mview/"]}],"documents":[{"id":106363,"url":"https://wordpress.org/plugins/mview/","title":"mView 豆瓣电影 – WordPress.org plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":"mView 豆瓣电影, latest version 1.0.3, last modified 2016-11-03. Closed as of October 23, 2026, not available for download; closure described as temporary pending full review. No security notice on page.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}