{"id":"CVE-2026-124833","kind":"vulnerability","aliases":["CVE-2026-124833"],"related":[],"title":"Ahime Image Printer WordPress plugin: unchecked uploads let anyone run code","description":"The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.","summary":"The Ahime Image Printer WordPress plugin through 1.0.0 does not check the name, extension or type of uploaded files before saving them to disk. An unauthenticated attacker can upload a PHP file and run code on the server.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ahime-image-printer","fixed":[],"affected":"<= 1.0.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["abandoned","package","php","self-hosted","unpatched","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Run 'wp plugin list' or open Plugins in WordPress admin and look for ahime-image-printer (1.0.0 is the only release). Search wp-content (especially uploads and the plugin folder) for unexpected .php files, for example: find wp-content -name '*.php' -newer wp-config.php. Check access logs for unauthenticated POSTs to the plugin's upload handler.","fix":"No patched version exists. The plugin was closed on wordpress.org on 2024-10-08 (security issue) and is not downloadable; the only version, 1.0.0, is affected. Deactivate and delete the plugin, then check for planted PHP files.","status":"open","published_at":"2026-11-13T06:16:54+00:00","first_seen_at":"2026-11-13T06:42:17+00:00","triaged_at":"2026-11-13T06:42:22+00:00","updated_at":"2026-11-13T06:43:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T06:42:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Ahime Image Printer WordPress plugin: unchecked uploads let anyone run code","impact":"high","summary":"The Ahime Image Printer WordPress plugin through 1.0.0 does not check the name, extension or type of uploaded files before saving them to disk. An unauthenticated attacker can upload a PHP file and run code on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the server and takes over the site","analyst_note":"Confirm the fixed version or removal status of the Ahime Image Printer plugin in the WordPress plugin directory or NVD references.","how_to_check":"- Check whether the `Ahime Image Printer` plugin is installed and its version in the WordPress admin under Plugins.\n- Look for uploaded `.php` files in the plugin's upload directories on the server.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Ahime Image Printer plugin at version 1.0.0 or earlier are exposed, because the upload handler accepts any file type without authentication. Sites without this plugin are not affected. The sources do not say whether a configuration change limits exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000715,"input_tokens":4535,"output_tokens":524,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version or removal status of the Ahime Image Printer plugin in the WordPress plugin directory or NVD references.","search":"'-124833':14A,17A '-2026':13A,16A '1.0.0':37B,75C 'abandon':22B 'ahim':1A,31B,69C 'ahime':19A 'ahime-image-printer':18A 'allow':92C 'anyon':9A 'arbitrari':97C 'attack':56B,94C 'check':40B 'code':11A,64B,103C 'cve':12A,15A 'disk':53B,91C 'execut':102C 'extens':43B,81C 'file':48B,61B,86C,98C 'host':27B 'imag':2A,32B,70C 'image':20A 'includ':99C 'let':8A 'name':42B,80C 'packag':23B 'php':24B,60B,100C 'plugin':5A,35B,73C 'printer':3A,21A,33B,71C 'run':10A,63B 'save':50B 'self':26B 'self-host':25B 'server':67B,106C 'type':45B,83C 'unauthent':55B,93C 'uncheck':6A 'unpatch':28B 'upload':7A,47B,58B,85C,96C 'valid':78C 'wordpress':4A,29B,34B,72C 'write':88C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites that have the Ahime Image Printer plugin (slug ahime-image-printer) installed, version 1.0.0 or earlier. The upload flaw needs no login. Sites without the plugin can skip it. The same plugin also has a separate path-traversal file-download flaw, CVE-2024-49245.","tier":"B","verified":{"fix":{"at":"2026-11-13T06:43:37Z","by":"analyst","doc":"https://wordpress.org/plugins/ahime-image-printer/","run_id":3824}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ahimeimageprinter"],"ptokens":["ahime","image","printer"],"labels":["abandoned","critical","package","php","selfhosted","unpatched","wordpress"],"campaign_type":null,"search_a":"'-124833':14A,17A '-2026':13A,16A 'ahim':1A 'ahime':19A 'ahime-image-printer':18A 'anyon':9A 'code':11A 'cve':12A,15A 'imag':2A 'image':20A 'let':8A 'plugin':5A 'printer':3A,21A 'run':10A 'uncheck':6A 'upload':7A 'wordpress':4A","search_b":"'1.0.0':37B 'abandon':22B 'ahim':31B 'attack':56B 'check':40B 'code':64B 'disk':53B 'extens':43B 'file':48B,61B 'host':27B 'imag':32B 'name':42B 'packag':23B 'php':24B,60B 'plugin':35B 'printer':33B 'run':63B 'save':50B 'self':26B 'self-host':25B 'server':67B 'type':45B 'unauthent':55B 'unpatch':28B 'upload':47B,58B 'wordpress':29B,34B","search_c":"'1.0.0':75C 'ahim':69C 'allow':92C 'arbitrari':97C 'attack':94C 'code':103C 'disk':91C 'execut':102C 'extens':81C 'file':86C,98C 'imag':70C 'includ':99C 'name':80C 'php':100C 'plugin':73C 'printer':71C 'server':106C 'type':83C 'unauthent':93C 'upload':85C,96C 'valid':78C 'wordpress':72C 'write':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124833","severity":null,"published_at":"2026-11-13T06:16:54+00:00","modified_at":"2026-11-13T06:16:54+00:00","first_seen_at":"2026-11-13T06:42:17+00:00","fetched_at":"2026-11-13T06:42:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124833:3824","url":"https://wordpress.org/plugins/ahime-image-printer/","severity":null,"published_at":"2026-11-13T06:43:37+00:00","modified_at":"2026-11-13T06:43:37+00:00","first_seen_at":"2026-11-13T06:43:37+00:00","fetched_at":"2026-11-13T06:43:37+00:00","note":"Per hol.org summary: unauthenticated arbitrary file upload, <=1.0.0. NVD page returned nothing; the upload CVE text is from secondary source only. Plugin closed on wordpress.org 2024-10-08 (primary page); Wordfence lists it Removed/unpatched for sibling CVE-2024-49245 (different bug). No exploitation or PoC seen.","cites":["https://wordpress.org/plugins/ahime-image-printer/","https://hol.org/guard/security/cves/CVE-2026-124833-ahime-image-printer-100-unauthenticated-arbitrary","https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ahime-image-printer"]}],"documents":[{"id":143376,"url":"https://wordpress.org/plugins/ahime-image-printer/","title":"ahime-image-printer plugin page (closed Oct 8, 2024, security issue)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":143378,"url":"https://hol.org/guard/security/cves/CVE-2026-124833-ahime-image-printer-100-unauthenticated-arbitrary","title":"HOL Guard: CVE-2026-124833 Ahime Image Printer <= 1.0.0 Unauthenticated Arbitrary File Upload","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":143379,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ahime-image-printer","title":"Wordfence: Ahime Image Printer (Removed, unpatched)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}