{"id":"CVE-2026-115212","published":"2026-11-09T07:17:27.820","lastModified":"2026-11-10T16:28:46.510","description":"The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/c1fd09cb-0df7-4643-a888-1873c90e7b64/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The mView 豆瓣电影 WordPress plugin (≤1.0.3) allows any authenticated user—including low-privilege roles like subscribers—to upload arbitrary PHP files due to missing file type validation, capability checks, and authorization enforcement. This enables remote code execution by saving malicious PHP files to a web-accessible directory.","exploitability":"Exploitation is straightforward for any authenticated WordPress user with subscriber-level privileges, requiring no user interaction or special conditions beyond valid login credentials.","blast_radius":"Successful exploitation grants full remote code execution with the privileges of the web server process, risking complete site compromise, data exfiltration, and potential lateral movement within the hosting environment.","remediation":"Upgrade to version 1.0.4 or later of the mView 豆瓣电影 plugin, which addresses the vulnerability by implementing proper file validation, capability checks, and access controls.","detection":"Defenders should monitor WordPress upload logs for PHP files uploaded via the plugin’s endpoint (e.g., /wp-admin/admin-ajax.php?action=mview_upload), especially when triggered by low-privilege users; look for HTTP POST requests to upload endpoints with .php extensions and non-image Content-Type or filename headers.","tags":["rce","file-upload","auth-bypass","wordpress","plugin-vuln","web"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:46:41.326Z"}}