{"id":"CVE-2026-118063","kind":"vulnerability","aliases":["CVE-2026-118063"],"related":[],"title":"WordPress Advance Guest Post plugin: unauthenticated upload lets attackers run PHP","description":"The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachable directory, which can lead to remote code execution depending on the server configuration.","summary":"The Advance Guest Post WordPress plugin through version 1.9 checks uploaded file extensions with a case-sensitive, incomplete rule that is easy to bypass. An unauthenticated visitor can upload executable PHP variants into a web-reachable directory, which can lead to remote code execution depending on server configuration.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"advance-guest-post","fixed":[],"affected":"<= 1.9","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","php","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","uploads-not-executable"],"how_to_check":"- In WordPress admin under Plugins, or run 'wp plugin list' (WP-CLI), look for advance-guest-post; any installed version (1.9 is the last release) is affected.\n- Look for unexpected PHP-variant files (.php5, .phtml, mixed-case .PHP) under wp-content/uploads and the plugin's upload directories.\n- Check whether the upload form/endpoint is reachable without login.","fix":"No fixed version exists. The plugin is closed on WordPress.org (since October 28, 2026) and unmaintained since 2015. Deactivate and delete it, or replace it with a maintained guest-post plugin.","status":"open","published_at":"2026-11-13T06:16:52+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","triaged_at":"2026-11-13T06:42:39+00:00","updated_at":"2026-11-13T06:45:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T06:42:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Advance Guest Post plugin: unauthenticated upload lets attackers run PHP","impact":"high","summary":"The Advance Guest Post WordPress plugin through version 1.9 checks uploaded file extensions with a case-sensitive, incomplete rule that is easy to bypass. An unauthenticated visitor can upload executable PHP variants into a web-reachable directory, which can lead to remote code execution depending on server configuration.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary PHP code on the web server","analyst_note":"No fixed version or vendor advisory is in the sources; check the plugin's WordPress.org page or changelog for a patched release after 1.9.","how_to_check":"- Check the installed version of the Advance Guest Post plugin in the WordPress admin under Plugins, and treat `1.9` or earlier as affected.\n- Look for unexpected PHP files (such as `.php5`, `.phtml` or mixed-case `.PHP` files) in the plugin's upload directories under `wp-content/uploads`.\n- Confirm whether the plugin's upload endpoint is reachable without logging in.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","uploads-not-executable"],"who_is_affected":"Sites running the Advance Guest Post plugin version 1.9 or earlier, where the guest post upload feature accepts files from anonymous visitors. Impact depends on server configuration: PHP execution in the upload directory is what turns an upload into code execution. Sites that do not run this plugin can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000787,"input_tokens":4567,"output_tokens":661,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"No fixed version or vendor advisory is in the sources; check the plugin's WordPress.org page or changelog for a patched release after 1.9.","search":"'-118063':14A,17A '-2026':13A,16A '1.9':36B,85C 'advanc':2A,29B,79C 'advance':19A 'advance-guest-post':18A 'allow':108C 'arbitrari':112C 'attack':9A 'bypass':52B,107C 'case':44B,96C 'case-sensit':43B,95C 'check':37B,101C 'code':72B,129C 'configur':77B,135C 'cve':12A,15A 'depend':74B,131C 'directori':66B,123C 'easi':50B 'execut':58B,73B,115C,130C 'extens':40B,100C 'file':39B,91C,113C 'guest':3A,20A,30B,80C 'host':26B 'includ':114C 'incomplet':46B,99C 'lead':69B,126C 'let':8A 'packag':22B 'php':11A,23B,59B,116C 'plugin':5A,33B,83C 'post':4A,21A,31B,81C 'proper':88C 'reachabl':65B,122C 'reli':92C 'remot':71B,128C 'rule':47B 'run':10A 'self':25B 'self-host':24B 'sensit':45B,97C 'server':76B,134C 'trivial':106C 'unauthent':6A,54B,103C 'upload':7A,38B,57B,90C,111C 'user':104C 'valid':89C 'variant':60B,117C 'version':35B 'visitor':55B 'web':64B,121C 'web-reach':63B,120C 'wordpress':1A,27B,32B,82C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advance Guest Post plugin version 1.9 or earlier, where the guest post upload feature accepts files from anonymous visitors. Impact depends on server configuration: PHP execution in the upload directory is what turns an upload into code execution. Sites that do not run this plugin can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T06:45:00Z","by":"analyst","doc":"https://wordpress.org/plugins/advance-guest-post/","run_id":3826},"products":{"at":"2026-11-13T06:45:00Z","by":"analyst","doc":"https://wordpress.org/plugins/advance-guest-post/","run_id":3826}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["advanceguestpost"],"ptokens":["advance","guest","post"],"labels":["critical","package","php","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-118063':14A,17A '-2026':13A,16A 'advanc':2A 'advance':19A 'advance-guest-post':18A 'attack':9A 'cve':12A,15A 'guest':3A,20A 'let':8A 'php':11A 'plugin':5A 'post':4A,21A 'run':10A 'unauthent':6A 'upload':7A 'wordpress':1A","search_b":"'1.9':36B 'advanc':29B 'bypass':52B 'case':44B 'case-sensit':43B 'check':37B 'code':72B 'configur':77B 'depend':74B 'directori':66B 'easi':50B 'execut':58B,73B 'extens':40B 'file':39B 'guest':30B 'host':26B 'incomplet':46B 'lead':69B 'packag':22B 'php':23B,59B 'plugin':33B 'post':31B 'reachabl':65B 'remot':71B 'rule':47B 'self':25B 'self-host':24B 'sensit':45B 'server':76B 'unauthent':54B 'upload':38B,57B 'variant':60B 'version':35B 'visitor':55B 'web':64B 'web-reach':63B 'wordpress':27B,32B","search_c":"'1.9':85C 'advanc':79C 'allow':108C 'arbitrari':112C 'bypass':107C 'case':96C 'case-sensit':95C 'check':101C 'code':129C 'configur':135C 'depend':131C 'directori':123C 'execut':115C,130C 'extens':100C 'file':91C,113C 'guest':80C 'includ':114C 'incomplet':99C 'lead':126C 'php':116C 'plugin':83C 'post':81C 'proper':88C 'reachabl':122C 'reli':92C 'remot':128C 'sensit':97C 'server':134C 'trivial':106C 'unauthent':103C 'upload':90C,111C 'user':104C 'valid':89C 'variant':117C 'web':121C 'web-reach':120C 'wordpress':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118063","severity":null,"published_at":"2026-11-13T06:16:52+00:00","modified_at":"2026-11-13T06:16:52+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","fetched_at":"2026-11-13T06:42:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118063:3826","url":"https://wordpress.org/plugins/advance-guest-post/","severity":null,"published_at":"2026-11-13T06:45:00+00:00","modified_at":"2026-11-13T06:45:00+00:00","first_seen_at":"2026-11-13T06:45:00+00:00","fetched_at":"2026-11-13T06:45:00+00:00","note":"No patched release; WordPress.org page shows plugin closed 2026-10-28 pending review, last version 1.9 (2015). Exploitation/PoC not found; no vendor advisory beyond NVD.","cites":["https://wordpress.org/plugins/advance-guest-post/","https://nvd.nist.gov/vuln/detail/CVE-2026-118063"]}],"documents":[{"id":143474,"url":"https://wordpress.org/plugins/advance-guest-post/","title":"advance-guest-post plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":"Plugin closed as of October 28, 2026, not available for download; closure temporary pending full review. Version 1.9, last updated 12 years ago.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":143475,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118063","title":"NVD CVE-2026-118063","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}