---
id: "CVE-2026-118063"
page: "https://infrastack.ai/live/CVE-2026-118063"
kind: "vulnerability"
aliases: ["CVE-2026-118063"]
title: "WordPress Advance Guest Post plugin: unauthenticated upload lets attackers run PHP"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "advance-guest-post", "fixed": [], "affected": "<= 1.9", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "php", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "uploads-not-executable"]
published_at: "2026-11-13T06:16:52+00:00"
first_seen_at: "2026-11-13T06:42:16+00:00"
updated_at: "2026-11-13T06:45:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118063", "first_seen_at": "2026-11-13T06:42:16+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/advance-guest-post/", "first_seen_at": "2026-11-13T06:45:00+00:00", "cites": ["https://wordpress.org/plugins/advance-guest-post/", "https://nvd.nist.gov/vuln/detail/CVE-2026-118063"]}]
exploit_sources: []
---

# WordPress Advance Guest Post plugin: unauthenticated upload lets attackers run PHP

Link for people: https://infrastack.ai/live/CVE-2026-118063 (this .md is for agents)

The Advance Guest Post WordPress plugin through version 1.9 checks uploaded file extensions with a case-sensitive, incomplete rule that is easy to bypass. An unauthenticated visitor can upload executable PHP variants into a web-reachable directory, which can lead to remote code execution depending on server configuration.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:advance-guest-post affected <= 1.9 fixed no fixed version listed

## How to check

- In WordPress admin under Plugins, or run 'wp plugin list' (WP-CLI), look for advance-guest-post; any installed version (1.9 is the last release) is affected.
- Look for unexpected PHP-variant files (.php5, .phtml, mixed-case .PHP) under wp-content/uploads and the plugin's upload directories.
- Check whether the upload form/endpoint is reachable without login.

## Fix

No fixed version exists. The plugin is closed on WordPress.org (since October 28, 2026) and unmaintained since 2015. Deactivate and delete it, or replace it with a maintained guest-post plugin.

## Timeline

- 2026-11-13T06:42:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118063
- 2026-11-13T06:45:00+00:00 analyst https://wordpress.org/plugins/advance-guest-post/ — No patched release; WordPress.org page shows plugin closed 2026-10-28 pending review, last version 1.9 (2015). Exploitation/PoC not found; no vendor advisory beyond NVD.

## Documents

- [advisory] advance-guest-post plugin page (closed) https://wordpress.org/plugins/advance-guest-post/
- [describes] NVD CVE-2026-118063 https://nvd.nist.gov/vuln/detail/CVE-2026-118063

## From the sources

The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachable directory, which can lead to remote code execution depending on the server configuration.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_