Field brief
CVE‑2026‑118063: Critical WordPress plugin vulnerability remains unpatched
A critical file‑upload flaw in the Advance Guest Post WordPress plugin has no vendor advisory or patch yet, leaving sites at risk.
During the November 13‑14 window, no vendor advisory or patch was issued for CVE‑2026‑118063, a critical flaw in the Advance Guest Post WordPress plugin. The NVD record shows the plugin through version 1.9 fails to validate uploaded file extensions, allowing unauthenticated users to upload arbitrary PHP files into a web‑reachable directory, potentially enabling remote code execution. With a CVSS score of 9.8, this vulnerability is high‑risk, yet no CISA KEV listing or confirmed exploitation has been reported. WordPress site owners should immediately check the plugin version and upgrade to 2.0 or later, or remove the plugin entirely, to mitigate the risk. Regular vulnerability scans and plugin version checks remain essential to keep WordPress installations secure and keep them protected against future exploits. The NVD record provides detailed information and can be accessed here: NVD record.
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.