Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-13
Advance Guest Post - Security Vulnerability (CVE-2026-118065)
The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their files.
PLUGIN
Advance Guest Post
CVE-2026-118065
Risk Score
Threat Entry
Updated 2026-11-13
Advance Guest Post - Security Vulnerability (CVE-2026-118064)
The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute code remotely. Successful exploitation additionally requires the target to run PHP 7.x; on PHP 8.0 and later the vulnerable code path raises a fatal error before the file is written.
PLUGIN
Advance Guest Post
CVE-2026-118064
Risk Score
Threat Entry
Updated 2026-11-13
Advance Guest Post - Security Vulnerability (CVE-2026-118063)
The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachable directory, which can lead to remote code execution depending on the server configuration.
PLUGIN
Advance Guest Post
CVE-2026-118063
Risk Score