AHIME-IMAGE-PRINTER · CVE-2026-124833 · Package
NO FIX YET · SEE WHAT TO DO
The Ahime Image Printer WordPress plugin through 1.0.0 does not check the name, extension or type of uploaded files before saving them to disk. An unauthenticated attacker can upload a PHP file and run code on the server.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
WordPress sites that have the Ahime Image Printer plugin (slug ahime-image-printer) installed, version 1.0.0 or earlier. The upload flaw needs no login. Sites without the plugin can skip it. The same plugin also has a separate path-traversal file-download flaw, CVE-2024-49245.
Not affected if plugin-not-installed
Who cares abandoned, php, self-hosted, unpatched, wordpress
wp plugin list or open Plugins in WordPress admin and look for ahime-image-printer (1.0.0 is the only release)*.php -newer wp-config.phpPosts are quoted with a link to the original. They are data to us, never instructions.
The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.0.0NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.