CVE‑2026‑124833 remains unpatched, critical WordPress plugin flaw

The Ahime Image Printer WordPress plugin, through version 1.0.0, has a critical flaw that allows unauthenticated file uploads, potentially enabling PHP code execution. The vulnerability allows attackers to upload arbitrary files, including PHP, to the server, which could lead to remote code execution if the plugin writes files to a web-accessible directory. The NVD lists CVE‑2026‑124833 with a CVSS 9.8 score, but no vendor advisory or patch has been issued as of 2026‑11‑14. The CVSS score of 9.8 reflects the high severity of this flaw. Since no vendor advisory has been issued, users should proactively disable the plugin or restrict upload types until a patch is released. For more details, see the NVD entry here. The CISA KEV database does not list this CVE, and no active exploitation has been reported. Defenders should monitor the vendor for a patch release and apply it immediately once available, and consider disabling the plugin or restricting upload types until a fix arrives.