CVE-2026-81090 — Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF

CVE-2026-81090

Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF PUBLISHED

Description (CNA)

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.

Affected (CNA)

Vendor / product	Versions
Unknown / Gpx2Graphics	affected 0 through 0.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/92e50025-cfa4-4727-bd02-8f45196021ae/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.