Cyber Posture

CVE-2026-1756

High

Published: 04 February 2026

Published
04 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 29.9th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

The WP FOFT Loader plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WP_FOFT_Loader_Mimes::file_and_ext' function in all versions up to, and including, 2.1.39. This makes it possible for authenticated attackers, with Author-level…

more

access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly addresses the incorrect file type validation flaw by requiring comprehensive checks on file uploads for type, extension, and content validity.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and patching of the specific flaw in WP FOFT Loader versions up to 2.1.39 to eliminate the arbitrary file upload vulnerability.

SI-3 Malicious Code Protection partial match
preventdetect

Mitigates potential remote code execution from uploaded arbitrary files by scanning and blocking malicious code on the server.

Security SummaryAI

CVE-2026-1756 is an arbitrary file upload vulnerability in the WP FOFT Loader plugin for WordPress, stemming from incorrect file type validation in the WP_FOFT_Loader_Mimes::file_and_ext function. The issue affects all versions up to and including 2.1.39, as published on 2026-02-04. It is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).

Authenticated attackers with Author-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows uploading arbitrary files to the affected site's server, which may lead to remote code execution.

References include code excerpts from the vulnerable class-wp-foft-loader-mimes.php file at lines 31 and 45, a changeset 3453101 applying changes to the same file, and a Wordfence threat intelligence report detailing the issue.

Details

CWE(s)
CWE-434

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Arbitrary file upload vulnerability in public-facing WordPress plugin enables exploitation of public-facing application (T1190) and facilitates uploading web shells for remote code execution (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References