{"id":"CVE-2026-118064","kind":"vulnerability","aliases":["CVE-2026-118064"],"related":[],"title":"Advance Guest Post WordPress plugin lets anonymous visitors upload and run PHP files","description":"The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute code remotely.\n\nSuccessful exploitation additionally requires the target to run PHP 7.x; on PHP 8.0 and later the vulnerable code path raises a fatal error before the file is written.","summary":"The Advance Guest Post WordPress plugin through 1.9 checks only the first bytes of uploaded files and exposes its upload nonce to every visitor. An unauthenticated attacker can upload a PHP file and run code on the server, but only when PHP 7.x is in use, since PHP 8.0 and later stop the write with a fatal error.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"advance-guest-post","fixed":[],"affected":"<= 1.9","ecosystem":"wordpress"}],"ecosystems":[],"tags":["php","runtime","self-hosted","wordpress"],"not_affected_if":["php-8-or-later","plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: look for 'Advance Guest Post' (slug advance-guest-post) at 1.9 or earlier; or run: wp plugin list --name=advance-guest-post\n- Run php -v on the web server; the described exploit path needs PHP 7.x, and on PHP 8.0+ the code path fails with a fatal error before the file is written.\n- Look for unexpected .php files under wp-content/uploads and the plugin's folders.","fix":"No patched version exists. The plugin is closed on WordPress.org (since 2026-10-28, pending review) and the latest listed version is 1.9. Deactivate and delete the plugin, or move to PHP 8.0+ as a partial barrier.","status":"open","published_at":"2026-11-13T06:16:52+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","triaged_at":"2026-11-13T06:42:36+00:00","updated_at":"2026-11-13T06:45:13+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T06:42:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Advance Guest Post WordPress plugin lets anonymous visitors upload and run PHP files","impact":"high","summary":"The Advance Guest Post WordPress plugin through 1.9 checks only the first bytes of uploaded files and exposes its upload nonce to every visitor. An unauthenticated attacker can upload a PHP file and run code on the server, but only when PHP 7.x is in use, since PHP 8.0 and later stop the write with a fatal error.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Anonymous attackers run arbitrary PHP code on the web server","analyst_note":"Confirm the fixed plugin version and whether a patch exists; the sources give no fix, and the NVD page is the only source listed.","how_to_check":"- Check whether the `Advance Guest Post` plugin is installed and its version is `1.9` or earlier in the WordPress admin plugin list.\n- Check the PHP version with `php -v`; the exploit path requires PHP 7.x.\n- Look for unexpected PHP files in the plugin's upload directories in `wp-content/uploads`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["php-8-or-later","plugin-not-installed"],"who_is_affected":"Sites running the Advance Guest Post WordPress plugin version 1.9 or earlier on PHP 7.x are exposed, because anonymous visitors can reach the upload action. Sites on PHP 8.0 or later are not exploitable through this path according to the description. Sites that do not run the plugin can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000783,"input_tokens":4611,"output_tokens":644,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed plugin version and whether a patch exists; the sources give no fix, and the NVD page is the only source listed.","search":"'-118064':16A,19A '-2026':15A,18A '1.9':37B,96C '7':72B,148C '8.0':79B,152C 'action':108C 'addit':141C 'advanc':1A,31B,90C 'advance':21A 'advance-guest-post':20A 'allow':127C 'anonym':7A 'arbitrari':132C 'attack':56B 'author':105C 'byte':42B,126C 'check':38B,120C 'code':64B,137C,157C 'cve':14A,17A 'end':117C 'error':88B,162C 'everi':52B,114C 'execut':136C 'exploit':140C 'expos':47B,112C 'fatal':87B,161C 'file':13A,45B,61B,103C,123C,134C,165C 'first':41B 'front':116C 'front-end':115C 'guest':2A,22A,32B,91C 'host':28B 'later':81B,154C 'lead':125C 'let':6A 'nonc':50B,111C 'path':158C 'php':12A,24B,60B,71B,78B,133C,147C,151C 'plugin':5A,35B,94C 'post':3A,23A,33B,92C 'proper':99C 'rais':159C 'remot':138C 'requir':142C 'restrict':100C 'run':11A,63B,146C 'runtim':25B 'self':27B 'self-host':26B 'server':67B 'sinc':77B 'stop':82B 'success':139C 'target':144C 'unauthent':55B,128C 'upload':9A,44B,49B,58B,104C,107C,131C 'use':76B 'user':129C 'valid':102C 'visitor':8A,53B,118C 'vulner':156C 'wordpress':4A,29B,34B,93C 'write':84B 'written':167C 'x':73B,149C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advance Guest Post WordPress plugin version 1.9 or earlier on PHP 7.x are exposed, because anonymous visitors can reach the upload action. Sites on PHP 8.0 or later are not exploitable through this path according to the description. Sites that do not run the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["advanceguestpost"],"ptokens":["advance","guest","post"],"labels":["critical","php","runtime","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-118064':16A,19A '-2026':15A,18A 'advanc':1A 'advance':21A 'advance-guest-post':20A 'anonym':7A 'cve':14A,17A 'file':13A 'guest':2A,22A 'let':6A 'php':12A 'plugin':5A 'post':3A,23A 'run':11A 'upload':9A 'visitor':8A 'wordpress':4A","search_b":"'1.9':37B '7':72B '8.0':79B 'advanc':31B 'attack':56B 'byte':42B 'check':38B 'code':64B 'error':88B 'everi':52B 'expos':47B 'fatal':87B 'file':45B,61B 'first':41B 'guest':32B 'host':28B 'later':81B 'nonc':50B 'php':24B,60B,71B,78B 'plugin':35B 'post':33B 'run':63B 'runtim':25B 'self':27B 'self-host':26B 'server':67B 'sinc':77B 'stop':82B 'unauthent':55B 'upload':44B,49B,58B 'use':76B 'visitor':53B 'wordpress':29B,34B 'write':84B 'x':73B","search_c":"'1.9':96C '7':148C '8.0':152C 'action':108C 'addit':141C 'advanc':90C 'allow':127C 'arbitrari':132C 'author':105C 'byte':126C 'check':120C 'code':137C,157C 'end':117C 'error':162C 'everi':114C 'execut':136C 'exploit':140C 'expos':112C 'fatal':161C 'file':103C,123C,134C,165C 'front':116C 'front-end':115C 'guest':91C 'later':154C 'lead':125C 'nonc':111C 'path':158C 'php':133C,147C,151C 'plugin':94C 'post':92C 'proper':99C 'rais':159C 'remot':138C 'requir':142C 'restrict':100C 'run':146C 'success':139C 'target':144C 'unauthent':128C 'upload':104C,107C,131C 'user':129C 'valid':102C 'visitor':118C 'vulner':156C 'wordpress':93C 'written':167C 'x':149C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118064","severity":null,"published_at":"2026-11-13T06:16:52+00:00","modified_at":"2026-11-13T06:16:52+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","fetched_at":"2026-11-13T06:42:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118064:3825","url":"https://wordpress.org/plugins/advance-guest-post/","severity":null,"published_at":"2026-11-13T06:45:13+00:00","modified_at":"2026-11-13T06:45:13+00:00","first_seen_at":"2026-11-13T06:45:13+00:00","fetched_at":"2026-11-13T06:45:13+00:00","note":"NVD describes the bug; WordPress.org directory page shows the plugin closed since 2026-10-28 pending review, latest version 1.9, no patched release. No exploitation or PoC found.","cites":["https://wordpress.org/plugins/advance-guest-post/","https://nvd.nist.gov/vuln/detail/CVE-2026-118064"]}],"documents":[{"id":143474,"url":"https://wordpress.org/plugins/advance-guest-post/","title":"advance-guest-post plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":"Plugin closed as of October 28, 2026, not available for download; closure temporary pending full review. Version 1.9, last updated 12 years ago.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":143477,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118064","title":"NVD CVE-2026-118064","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}