Cyber Posture

CVE-2026-1565

High

Published: 26 February 2026

Published
26 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0030 53.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WPUF_Admin_Settings::check_filetype_and_ext' function and in the 'Admin_Tools::check_filetype_and_ext' function in all…

more

versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Requires effective input validation at entry points to reject invalid file types, directly preventing arbitrary file uploads due to flawed filetype checks in the plugin's functions.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and correction of flaws like the improper file validation in WPUF_Admin_Settings and Admin_Tools, including applying the available patch.

SI-3 Malicious Code Protection partial match
preventdetect

Deploys malicious code protection at system entry points to scan and block dangerous uploaded files that could lead to remote code execution.

Security SummaryAI

CVE-2026-1565 is an arbitrary file upload vulnerability in the User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress. It arises from incorrect file type validation in the WPUF_Admin_Settings::check_filetype_and_ext function and the Admin_Tools::check_filetype_and_ext function, affecting all versions up to and including 4.2.8. The issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Authenticated attackers with Author-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By bypassing file type checks, they can upload arbitrary files to the affected site's server, potentially leading to remote code execution.

References point to specific code locations in the plugin's admin settings and tools files at revision 3448772, highlighting lines 571, 600, 444, and 537 where the flawed validation occurs. A related changeset (3468395) in the Admin_Tools.php file suggests a patch addressing the issue in the trunk.

Details

CWE(s)
CWE-434

AI Security AnalysisAI

AI Category
Other AI Platforms
Risk Domain
N/A
OWASP Top 10 for LLMs 2025
None mapped
MITRE ATLAS Techniques
None mapped
Classification Reason
Matched keywords: ai

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Arbitrary file upload vulnerability in public-facing WordPress plugin enables exploitation of public-facing web application (T1190), bypassing file validation to upload malicious files for potential RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References