Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-84738: AF Companion plugin lets manager upload files to run code
CVE-2026-84738 · published 24 days ago
Summary
The AF Companion WordPress add‑on allows users with a basic store‑manager role to add any type of file through its import tool, including computer code files. This can let an attacker place malicious code on the site and take control of it. Update the plugin to version 2.2.0 or newer, or disable the import feature and restrict file uploads to trusted formats.
What to do
- Update unknown af companion to version 2.2.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | af companion | < 2.2.0 |
Original advisory text
AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE
The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-94Code Injection
Timeline
Published18 Sep 2026
Updated12 Oct 2026
First seen18 Sep 2026
Track software like this
Free during beta