Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-84171: Piclect plugin allows anyone to upload files and execute code
CVE-2026-84171 · published 1 month ago
Summary
The Piclect WordPress plugin does not check the name or type of files that are uploaded, so anyone on the internet can place arbitrary files in a public folder on your web server. Those files can then be run as code, giving an attacker full control of the server. To protect your site, upgrade to a version that adds proper file‑type validation, or disable the upload feature until it is fixed, and consider adding web‑server rules that block execution of uploaded files.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | wp images upload on piclect | <= 1.0 |
Original advisory text
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated at...
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-434Unrestricted File Upload
Timeline
Published12 Sep 2026
Updated11 Oct 2026
First seen12 Sep 2026
Track software like this
Free during beta