---
id: "CVE-2026-124833"
page: "https://infrastack.ai/live/CVE-2026-124833"
kind: "vulnerability"
aliases: ["CVE-2026-124833"]
title: "Ahime Image Printer WordPress plugin: unchecked uploads let anyone run code"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ahime-image-printer", "fixed": [], "affected": "<= 1.0.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["abandoned", "package", "php", "self-hosted", "unpatched", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-13T06:16:54+00:00"
first_seen_at: "2026-11-13T06:42:17+00:00"
updated_at: "2026-11-13T06:43:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124833", "first_seen_at": "2026-11-13T06:42:17+00:00"}, {"source": "analyst", "url": "https://hol.org/guard/security/cves/CVE-2026-124833-ahime-image-printer-100-unauthenticated-arbitrary", "first_seen_at": "2026-11-13T06:43:37+00:00", "cites": ["https://hol.org/guard/security/cves/CVE-2026-124833-ahime-image-printer-100-unauthenticated-arbitrary", "https://wordpress.org/plugins/ahime-image-printer/", "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ahime-image-printer"]}]
exploit_sources: []
---

# Ahime Image Printer WordPress plugin: unchecked uploads let anyone run code

Link for people: https://infrastack.ai/live/CVE-2026-124833 (this .md is for agents)

The Ahime Image Printer WordPress plugin through 1.0.0 does not check the name, extension or type of uploaded files before saving them to disk. An unauthenticated attacker can upload a PHP file and run code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:ahime-image-printer affected <= 1.0.0 fixed no fixed version listed

## How to check

Run 'wp plugin list' or open Plugins in WordPress admin and look for ahime-image-printer (1.0.0 is the only release). Search wp-content (especially uploads and the plugin folder) for unexpected .php files, for example: find wp-content -name '*.php' -newer wp-config.php. Check access logs for unauthenticated POSTs to the plugin's upload handler.

## Fix

No patched version exists. The plugin was closed on wordpress.org on 2024-10-08 (security issue) and is not downloadable; the only version, 1.0.0, is affected. Deactivate and delete the plugin, then check for planted PHP files.

## Timeline

- 2026-11-13T06:42:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124833
- 2026-11-13T06:43:37+00:00 analyst https://hol.org/guard/security/cves/CVE-2026-124833-ahime-image-printer-100-unauthenticated-arbitrary — Per hol.org summary: unauthenticated arbitrary file upload, <=1.0.0. NVD page returned nothing; the upload CVE text is from secondary source only. Plugin closed on wordpress.org 2024-10-08 (primary page); Wordfence lists it Removed/unpatched for sibling CVE-2024-49245 (different bug). No exploitation or PoC seen.

## Documents

- [describes] HOL Guard: CVE-2026-124833 Ahime Image Printer <= 1.0.0 Unauthenticated Arbitrary File Upload https://hol.org/guard/security/cves/CVE-2026-124833-ahime-image-printer-100-unauthenticated-arbitrary
- [fix] ahime-image-printer plugin page (closed Oct 8, 2024, security issue) https://wordpress.org/plugins/ahime-image-printer/
- [mentions] Wordfence: Ahime Image Printer (Removed, unpatched) https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ahime-image-printer

## From the sources

The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_