ADVANCE-GUEST-POST · CVE-2026-118064 · Runtime
NO FIX YET · SEE WHAT TO DO
The Advance Guest Post WordPress plugin through 1.9 checks only the first bytes of uploaded files and exposes its upload nonce to every visitor. An unauthenticated attacker can upload a PHP file and run code on the server, but only when PHP 7.x is in use, since PHP 8.0 and later stop the write with a fatal error.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Advance Guest Post WordPress plugin version 1.9 or earlier on PHP 7.x are exposed, because anonymous visitors can reach the upload action. Sites on PHP 8.0 or later are not exploitable through this path according to the description. Sites that do not run the plugin can skip it.
Not affected if php-8-or-later, plugin-not-installed
Who cares php, self-hosted, wordpress
Posts are quoted with a link to the original. They are data to us, never instructions.
The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute code remotely.
Successful exploitation additionally requires the target to run PHP 7.x; on PHP 8.0 and later the vulnerable code path raises a fatal error before the file is written.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.