{"id":"CVE-2026-121497","kind":"vulnerability","aliases":["CVE-2026-121497"],"related":[],"title":"AskAny WordPress plugin: unauthenticated file upload lets attackers run PHP code","description":"The AskAny  WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled.","summary":"The AskAny WordPress plugin before 2.2.0 does not check the extension or content of files attached to chat messages, trusting the browser-supplied file type. An unauthenticated visitor can upload a PHP file and run arbitrary code on the site when visitor attachments are enabled.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["askany-plugin","php","runtime","wordpress"],"not_affected_if":["attachments-disabled","plugin-2.2.0-or-later"],"how_to_check":"- Check the installed AskAny plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the plugin's version header.\n- Check whether visitor file attachments are enabled in the AskAny plugin settings.","fix":"- AskAny WordPress plugin: move to `2.2.0` or later.","status":"open","published_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","triaged_at":"2026-11-11T06:27:32+00:00","updated_at":"2026-11-11T06:27:32+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T06:27:32Z","model":"claude-haiku-5-5","output":{"fix":"- AskAny WordPress plugin: move to `2.2.0` or later.","reach":"internet","title":"AskAny WordPress plugin: unauthenticated file upload lets attackers run PHP code","impact":"high","summary":"The AskAny WordPress plugin before 2.2.0 does not check the extension or content of files attached to chat messages, trusting the browser-supplied file type. An unauthenticated visitor can upload a PHP file and run arbitrary code on the site when visitor attachments are enabled.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","askany-plugin","php"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary PHP code on the web server","analyst_note":"Confirm the affected version range and whether a patched release is published on the WordPress plugin directory or NVD; the source gives only 'before 2.2.0'.","how_to_check":"- Check the installed AskAny plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the plugin's version header.\n- Check whether visitor file attachments are enabled in the AskAny plugin settings.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-2.2.0-or-later","attachments-disabled"],"who_is_affected":"Only WordPress sites running the AskAny plugin before 2.2.0 with visitor attachments enabled are exposed. Sites without the plugin, or with attachments turned off, are not affected by the description given.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000744,"input_tokens":4538,"output_tokens":581,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121497':14A,17A '-2026':13A,16A '2.2.0':29B,75C 'allow':98C 'arbitrari':60B,107C 'askani':1A,19B,25B,71C 'askany-plugin':18B 'attach':39B,67B,85C,111C 'attack':8A 'browser':46B,92C 'browser-suppli':45B,91C 'chat':41B,87C 'check':32B 'code':11A,61B,108C 'content':36B,82C 'cve':12A,15A 'enabl':69B,113C 'execut':106C 'extens':34B,80C 'file':5A,38B,48B,57B,84C,94C,104C 'instead':96C 'let':7A 'messag':42B,88C 'php':10A,21B,56B,103C 'plugin':3A,20B,27B,73C 'run':9A,59B 'runtim':22B 'site':64B 'suppli':47B,93C 'trust':43B,89C 'type':49B,95C 'unauthent':4A,51B,99C 'upload':6A,54B,102C 'user':100C 'valid':78C 'visitor':52B,66B,110C 'wordpress':2A,23B,26B,72C","nicknames":[],"mitigations":[],"who_affected":"Only WordPress sites running the AskAny plugin before 2.2.0 with visitor attachments enabled are exposed. Sites without the plugin, or with attachments turned off, are not affected by the description given.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["askanyplugin","critical","php","runtime","wordpress"],"campaign_type":null,"search_a":"'-121497':14A,17A '-2026':13A,16A 'askani':1A 'attack':8A 'code':11A 'cve':12A,15A 'file':5A 'let':7A 'php':10A 'plugin':3A 'run':9A 'unauthent':4A 'upload':6A 'wordpress':2A","search_b":"'2.2.0':29B 'arbitrari':60B 'askani':19B,25B 'askany-plugin':18B 'attach':39B,67B 'browser':46B 'browser-suppli':45B 'chat':41B 'check':32B 'code':61B 'content':36B 'enabl':69B 'extens':34B 'file':38B,48B,57B 'messag':42B 'php':21B,56B 'plugin':20B,27B 'run':59B 'runtim':22B 'site':64B 'suppli':47B 'trust':43B 'type':49B 'unauthent':51B 'upload':54B 'visitor':52B,66B 'wordpress':23B,26B","search_c":"'2.2.0':75C 'allow':98C 'arbitrari':107C 'askani':71C 'attach':85C,111C 'browser':92C 'browser-suppli':91C 'chat':87C 'code':108C 'content':82C 'enabl':113C 'execut':106C 'extens':80C 'file':84C,94C,104C 'instead':96C 'messag':88C 'php':103C 'plugin':73C 'suppli':93C 'trust':89C 'type':95C 'unauthent':99C 'upload':102C 'user':100C 'valid':78C 'visitor':110C 'wordpress':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121497","severity":null,"published_at":"2026-11-11T06:17:16+00:00","modified_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","fetched_at":"2026-11-11T06:25:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}