CVE-2026-16250 — Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

CVE-2026-16250

Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload PUBLISHED

Description (CNA)

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.

Affected (CNA)

Vendor / product	Versions
Unknown / Personal QR Message	affected 0 through 1.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/05bd2683-ef3b-4816-a323-12d5e943612a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.