CVE-2026-1756
Published: 04 February 2026
Summary
CVE-2026-1756 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1756 is an arbitrary file upload vulnerability in the WP FOFT Loader plugin for WordPress, stemming from incorrect file type validation in the WP_FOFT_Loader_Mimes::file_and_ext function. The issue affects all versions up to and including 2.1.39, as published on 2026-02-04. It is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).
Authenticated attackers with Author-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows uploading arbitrary files to the affected site's server, which may lead to remote code execution.
References include code excerpts from the vulnerable class-wp-foft-loader-mimes.php file at lines 31 and 45, a changeset 3453101 applying changes to the same file, and a Wordfence threat intelligence report detailing the issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5387
Vulnerability details
The WP FOFT Loader plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WP_FOFT_Loader_Mimes::file_and_ext' function in all versions up to, and including, 2.1.39. This makes it possible for authenticated attackers, with Author-level…
more
access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vulnerability in public-facing WordPress plugin enables exploitation of public-facing application (T1190) and facilitates uploading web shells for remote code execution (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the incorrect file type validation flaw by requiring comprehensive checks on file uploads for type, extension, and content validity.
Mandates timely identification, reporting, and patching of the specific flaw in WP FOFT Loader versions up to 2.1.39 to eliminate the arbitrary file upload vulnerability.
Mitigates potential remote code execution from uploaded arbitrary files by scanning and blocking malicious code on the server.