CVE-2026-84171 PUBLISHED

WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload

Assigner: WPScan
Reserved: 01.09.2026 Published: 12.09.2026 Updated: 12.09.2026

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.

Product Status

Vendor Unknown
Product WP images upload on piclect
Versions Default: unknown
  • affected from 0 to 1.0 (incl.)

Credits

  • João Ramos Maciel finder
  • WPScan coordinator

References

Problem Types

  • CWE-434 Unrestricted Upload of File with Dangerous Type CWE