CVE-2026-84171 — WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload

CVE-2026-84171

WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload PUBLISHED

Description (CNA)

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.

Affected (CNA)

Vendor / product	Versions
Unknown / WP images upload on piclect	affected 0 through 1.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/e5b9fd87-92a7-4fc6-b8b2-896b87d97c40/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.