Overview
A critical unrestricted file upload vulnerability has been disclosed in the Anton Extensions WordPress plugin, tracked as CVE-2026-104028. The plugin, through version 1.2.2, performs no capability check, no nonce verification, and no file-type validation before writing attacker-supplied content to an attacker-chosen path on the server. That combination means an unauthenticated visitor can upload an arbitrary PHP file to a web-accessible location and achieve remote code execution (RCE) against the underlying site.
Threat-intelligence trackers list a CVSS score as high as 9.3–9.8 (Critical) for the flaw, reflecting the full chain from zero-privilege network access straight to code execution.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-104028 |
| CWE | CWE-434 — Unrestricted Upload of File with Dangerous Type |
| Attack Vector | Network |
| Authentication | None Required |
| Privileges Required | None |
| User Interaction | None |
| Affected Versions | Anton Extensions through 1.2.2 |
| Fixed Version | Not published at time of writing — see Mitigation |
| Assigner | WPScan |
How It Works
WordPress plugins that accept file uploads are expected to run three checks before writing anything to disk: a capability check (does the requester have permission to upload?), nonce verification (did the request originate from a legitimate, same-site form?), and file-type validation (is the uploaded content actually an image, document, or other expected type?).
Anton Extensions skips all three. Its upload handler writes attacker-supplied content directly to an attacker-chosen path without verifying who is asking, whether the request is a forged cross-site call, or what kind of file is being written. An attacker can submit a request containing PHP source disguised as any filename and have it saved somewhere under the web root — then simply request that file's URL to execute it.
Because no session or credentials are required, this is exploitable by any unauthenticated actor who can reach the site, making it attractive for mass, automated scanning and exploitation.
Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | High — a PHP web shell exposes the full database, wp-config.php credentials, and any other data on the host |
| Integrity | High — attacker-controlled code can modify site content, inject malware, or create backdoor admin accounts |
| Availability | High — attackers can deface, wipe, or ransom the site once shell access is established |
| Automatable | Yes — no authentication or user interaction needed, making this scriptable against mass targets |
Attack Chain
- Reconnaissance — Attacker identifies a WordPress site running Anton Extensions ≤ 1.2.2.
- Unauthenticated upload — Attacker submits a crafted request to the plugin's upload handler, supplying PHP code as the file content and choosing the destination path.
- Shell execution — Attacker requests the uploaded file's URL directly, executing the embedded PHP with the web server's privileges.
- Full compromise — The attacker pivots from a web shell to database access, credential theft, malware injection, or lateral movement across shared hosting.
Mitigation
Immediate Actions
- No patched release has been published as of this writing. Until one lands, consider deactivating Anton Extensions or removing it entirely if it isn't business-critical.
- If you must keep the plugin active, place a WAF in front of the site with rules blocking PHP-extension uploads and requests to unexpected upload-handler paths.
- Restrict write access to the uploads directory via web server configuration (e.g., disable PHP execution inside
wp-content/uploads/) as a defense-in-depth measure independent of this specific plugin.
Detection Opportunities
- Audit the WordPress uploads directory and any custom paths the plugin writes to for unexpected
.php,.phtml, or double-extension files (e.g.,image.php.jpg). - Review web server access logs for POST requests to the plugin's upload endpoint from IPs with no prior legitimate session activity.
- Use a file-integrity monitor to flag new executable files appearing outside of normal deployment or update processes.
Defence-in-Depth
- Run PHP with the lowest privileges necessary and disable dangerous functions (
exec,shell_exec,system) where feasible at the hosting level. - Keep offline, versioned backups so a confirmed compromise can be remediated by restoring to a known-good state rather than attempting in-place cleanup.
- Audit all installed plugins for upload-handling code that doesn't call WordPress's own capability (
current_user_can()) and nonce (wp_verify_nonce()) APIs.
Background
Anton Extensions is a WordPress plugin offering a set of site-building add-ons. As with many smaller, less-scrutinized plugins in the ecosystem, the absence of basic WordPress security primitives — capability checks and nonces — around a file-write operation is what turns a convenience feature into a critical, unauthenticated path to full server compromise. The CVE was published on 2026-10-11; CosmicBytez Labs is tracking it for an upstream fix.