CVE-2026-121497 · Runtime
NO FIX YET · SEE WHAT TO DO
The AskAny WordPress plugin before 2.2.0 does not check the extension or content of files attached to chat messages, trusting the browser-supplied file type. An unauthenticated visitor can upload a PHP file and run arbitrary code on the site when visitor attachments are enabled.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only WordPress sites running the AskAny plugin before 2.2.0 with visitor attachments enabled are exposed. Sites without the plugin, or with attachments turned off, are not affected by the description given.
Not affected if attachments-disabled, plugin-2.2.0-or-later
Who cares askany-plugin, php, wordpress
wp-content/plugins/ for the plugin's version header.2.2.0 or later.The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.