CVE-2026-14560 — Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload

CVE-2026-14560

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload PUBLISHED

Description (CNA)

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

Affected (CNA)

Vendor / product	Versions
Unknown / teddy-bear-customize-addon	affected 0 through 1.0.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/aba51906-91dc-4e75-ad44-373fe128deee/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.