CVE-2026-1565
Published: 26 February 2026
Summary
CVE-2026-1565 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Other Platforms; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1565 is an arbitrary file upload vulnerability in the User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress. It arises from incorrect file type validation in the WPUF_Admin_Settings::check_filetype_and_ext function and the Admin_Tools::check_filetype_and_ext function, affecting all versions up to and including 4.2.8. The issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with Author-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By bypassing file type checks, they can upload arbitrary files to the affected site's server, potentially leading to remote code execution.
References point to specific code locations in the plugin's admin settings and tools files at revision 3448772, highlighting lines 571, 600, 444, and 537 where the flawed validation occurs. A related changeset (3468395) in the Admin_Tools.php file suggests a patch addressing the issue in the trunk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8875
Vulnerability details
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WPUF_Admin_Settings::check_filetype_and_ext' function and in the 'Admin_Tools::check_filetype_and_ext' function in all…
more
versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vulnerability in public-facing WordPress plugin enables exploitation of public-facing web application (T1190), bypassing file validation to upload malicious files for potential RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires effective input validation at entry points to reject invalid file types, directly preventing arbitrary file uploads due to flawed filetype checks in the plugin's functions.
Mandates timely identification, reporting, and correction of flaws like the improper file validation in WPUF_Admin_Settings and Admin_Tools, including applying the available patch.
Deploys malicious code protection at system entry points to scan and block dangerous uploaded files that could lead to remote code execution.