---
id: "CVE-2026-118064"
page: "https://infrastack.ai/live/CVE-2026-118064"
kind: "vulnerability"
aliases: ["CVE-2026-118064"]
title: "Advance Guest Post WordPress plugin lets anonymous visitors upload and run PHP files"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "advance-guest-post", "fixed": [], "affected": "<= 1.9", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["php", "runtime", "self-hosted", "wordpress"]
not_affected_if: ["php-8-or-later", "plugin-not-installed"]
published_at: "2026-11-13T06:16:52+00:00"
first_seen_at: "2026-11-13T06:42:16+00:00"
updated_at: "2026-11-13T06:45:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118064", "first_seen_at": "2026-11-13T06:42:16+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/advance-guest-post/", "first_seen_at": "2026-11-13T06:45:13+00:00", "cites": ["https://wordpress.org/plugins/advance-guest-post/", "https://nvd.nist.gov/vuln/detail/CVE-2026-118064"]}]
exploit_sources: []
---

# Advance Guest Post WordPress plugin lets anonymous visitors upload and run PHP files

Link for people: https://infrastack.ai/live/CVE-2026-118064 (this .md is for agents)

The Advance Guest Post WordPress plugin through 1.9 checks only the first bytes of uploaded files and exposes its upload nonce to every visitor. An unauthenticated attacker can upload a PHP file and run code on the server, but only when PHP 7.x is in use, since PHP 8.0 and later stop the write with a fatal error.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:advance-guest-post affected <= 1.9 fixed no fixed version listed

## How to check

- WordPress admin > Plugins: look for 'Advance Guest Post' (slug advance-guest-post) at 1.9 or earlier; or run: wp plugin list --name=advance-guest-post
- Run php -v on the web server; the described exploit path needs PHP 7.x, and on PHP 8.0+ the code path fails with a fatal error before the file is written.
- Look for unexpected .php files under wp-content/uploads and the plugin's folders.

## Fix

No patched version exists. The plugin is closed on WordPress.org (since 2026-10-28, pending review) and the latest listed version is 1.9. Deactivate and delete the plugin, or move to PHP 8.0+ as a partial barrier.

## Timeline

- 2026-11-13T06:42:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118064
- 2026-11-13T06:45:13+00:00 analyst https://wordpress.org/plugins/advance-guest-post/ — NVD describes the bug; WordPress.org directory page shows the plugin closed since 2026-10-28 pending review, latest version 1.9, no patched release. No exploitation or PoC found.

## Documents

- [advisory] advance-guest-post plugin page (closed) https://wordpress.org/plugins/advance-guest-post/
- [describes] NVD CVE-2026-118064 https://nvd.nist.gov/vuln/detail/CVE-2026-118064

## From the sources

The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute code remotely.

Successful exploitation additionally requires the target to run PHP 7.x; on PHP 8.0 and later the vulnerable code path raises a fatal error before the file is written.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_