CVE-2026-104028

Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

Affected

Anton Extensions

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.55% chance of exploitation in the next 30 days, 45th percentile

Published

2026-10-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/0be8a03e-d854-48db-bdc0-1beead3d7b91/

References

• CVE Record
• NVD entry