What is CVE-2026-12872?

CVE-2026-12872 is a critical-severity vulnerability in Webinfos, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.8/10. Published 2026-08-03.

How severe is CVE-2026-12872?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Arbitrary file upload in Webinfos

CVE-2026-12872

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path.

Vulnerability class: Unrestricted File Upload

EPSS: 0.008 (53.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Unknown Webinfos — versions 0

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-12872?: CVE-2026-12872 is a critical-severity vulnerability in Webinfos, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.8/10. Published 2026-08-03.
How severe is CVE-2026-12872?: Critical severity. CVSS v3 base score is 9.8 out of 10.