Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-14560: teddy-bear-customize-addon plugin lets attackers run code
CVE-2026-14560 · published 1 month ago
Summary
The teddy-bear-customize-addon add‑on for WordPress does not check uploaded files correctly, so a stranger could upload a malicious script. This could let them take control of your website. Update the plugin or remove it until a proper fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | teddy-bear-customize-addon | <= 1.0.5 |
Original advisory text
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing una...
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
10.0
Critical
Type
CWE-94Code Injection
Timeline
Published11 Sep 2026
Updated11 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta