Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-81402: DS Ad Rotator plugin lets anyone upload files, run code
CVE-2026-81402 · published 1 month ago
Summary
The DS Ad Rotator plugin for WordPress lets people who are not logged in upload any type of file to your site, including files that can run code. This can let an attacker place and run their own programs on your server, compromising the entire website. Check whether a newer, fixed version of the plugin is available, upgrade to it, or remove the plugin and use a safer alternative.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | ds ad rotator | <= 0.8 |
Original advisory text
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to ...
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-434Unrestricted File Upload
Timeline
Published12 Sep 2026
Updated11 Oct 2026
First seen12 Sep 2026
Track software like this
Free during beta