CVE-2026-75799 — YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache

CVE-2026-75799

YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache PUBLISHED

Description (CNA)

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.

Affected (CNA)

Vendor / product	Versions
Unknown / YAHMAN Add-ons	affected 0 before 0.9.31

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b12397e7-5d9b-42bf-bd31-5d3401bc4600/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.