Skip to content

CVE-2026-121497 Askany < 2.2.0 - Unauthenticated Arbitrary File Upload

CriticalCVSS 9.8
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled.

Affected products

No affected product data has been published yet.

References

  • wpscan.com exploit technical-description vdb-entry