CVE-2026-75799: Unauthenticated Arbitrary PHP File Upload in YAHMAN Add-ons for WordPress

Executive Summary

A critical vulnerability, CVE-2026-75799, has been disclosed in YAHMAN Add-ons, a multi-feature WordPress plugin (page views, Google AdSense/Analytics, social sharing, table of contents, related posts, sitemap, SEO, JSON-LD structured data, Open Graph, blog card previews, Twitter/Facebook timelines, and a carousel slider). The plugin fails to validate the file type of remote files it caches into a publicly accessible directory, which lets an unauthenticated attacker write arbitrary PHP files to the server. When the relevant caching feature is enabled, this results in remote code execution (RCE).

The flaw carries a CVSS 3.1 base score of 9.0 (Critical), with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H — network-exploitable, no privileges or user interaction required, though attack complexity is rated High and the vulnerability has a scope change (a successful exploit can affect resources beyond the vulnerable component itself). The issue is tracked as CWE-94 (Improper Control of Generation of Code — "Code Injection") and was assigned by WPScan, the CVE Numbering Authority (CNA) for WordPress plugin vulnerabilities. The CVE was reserved on August 18, 2026, disclosed publicly by WPScan on September 21, 2026, and published to NVD/CVE.org on September 23, 2026. The vulnerable functionality has reportedly been identified as the plugin's blog card cache feature, which fetches and caches remote URLs to render link-preview thumbnails.

As of this writing, there is no confirmed in-the-wild exploitation and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS places the estimated 30-day exploitation probability at roughly 0.24% (14.8th percentile) — low, but EPSS scores can move quickly once a technical write-up circulates. WPScan has reportedly withheld full proof-of-concept details until October 21, 2026 to give site owners a window to patch before technical exploitation details become public. The fix is available now in version 0.9.31, and given the unauthenticated, pre-auth nature of the flaw, sites running the plugin should not wait for the PoC embargo to lift before updating.

Vulnerability Details

Technical Analysis

How the Flaw Works

YAHMAN Add-ons bundles a "blog card" feature that generates rich link-preview cards — the kind of thumbnail-plus-title-and-excerpt embed commonly seen when a post links to another article. To render these previews, the plugin fetches a remote URL's associated assets and caches them locally inside a directory that is served directly over the web (i.e., publicly accessible without authentication).

The root cause is that the caching routine does not validate the type of the file it retrieves before writing it to that publicly accessible directory. According to the NVD description, this "does not validate the type of the remote files it caches," which means an attacker who can influence what URL or resource the plugin fetches can cause it to cache a file with a .php extension (or otherwise executable content) instead of the expected image or metadata file. Because no authentication is required to trigger the caching behavior (PR:N, UI:N) and the cache directory is web-accessible, the attacker can then request that cached file directly, causing the web server to execute it as PHP — full remote code execution, achieved without ever logging in.

CWE-94 (Code Injection) is the classification WPScan assigned, reflecting that the end result is attacker-controlled code execution on the server, even though the proximate cause resembles an unrestricted file-upload/file-type validation gap (commonly tracked as CWE-434 in other advisories). The AC:H (High attack complexity) component of the CVSS vector suggests exploitation requires the attacker to satisfy some precondition beyond simply sending a request — for example, getting the plugin to fetch attacker-controlled content through the blog card feature, or preparing a resource that behaves correctly when interpreted as the expected file type. The S:C (Scope Changed) component reflects that a successful attack can affect resources beyond the vulnerable plugin component itself — consistent with achieving code execution at the web server/PHP-interpreter level, well outside the plugin's own security scope.

Why This Matters

This is a pre-authentication vulnerability in a plugin that bundles a wide range of front-end-facing features (AdSense, analytics, social sharing, SEO metadata, blog cards, timelines, carousels), meaning it is likely enabled on public-facing content pages by design — exactly where an unauthenticated visitor (or automated scanner) has the most direct line of contact with the vulnerable code path. Because the exploit path writes a file directly to a publicly reachable directory, a successful attack does not require chaining through WordPress's authentication or plugin/theme editor functionality at all; it bypasses those controls entirely by abusing the plugin's own remote-caching behavior. Once a malicious PHP file is cached and reachable, an attacker effectively has a foothold for arbitrary code execution on the host — a starting point for site defacement, backdoor installation, credential theft, malware distribution, or pivoting deeper into the hosting environment.

Impact Assessment

Remediation

1. Update immediately. Upgrade YAHMAN Add-ons to version 0.9.31 or later, which validates the type of remote files before they are cached.
2. Inventory affected sites. Identify every WordPress installation running YAHMAN Add-ons prior to 0.9.31 — this plugin bundles many commonly enabled features (blog card, social, SEO, analytics), so it may be present on sites where administrators don't immediately associate it with "the SEO/analytics plugin."
3. Disable the blog card feature if you cannot patch immediately. Since the vulnerable behavior is tied to the plugin's remote file caching used by blog card previews, disabling that specific feature reduces exposure until the update can be applied.
4. Audit the plugin's cache directory. Check the publicly accessible cache directory used by the plugin for unexpected .php files or files with mismatched extensions/content, which would indicate prior exploitation attempts.
5. Review web server and access logs. Look for unusual POST/GET requests to the plugin's caching endpoints and for direct requests to newly created files inside the cache directory, particularly from unfamiliar or automated-looking user agents.
6. Deploy a web application firewall (WAF) rule to restrict direct execution of PHP files from upload/cache directories where feasible, as defense-in-depth regardless of patch status.
7. Track the PoC embargo. WPScan has reportedly delayed full technical disclosure until October 21, 2026 — treat that date as a deadline by which every affected installation should already be patched, since public exploitation details typically drive a sharp increase in opportunistic scanning.

Sources

• NVD — CVE-2026-75799 Detail
• CVE.org — CVE-2026-75799 Record
• WPScan — YAHMAN Add-ons Vulnerability Database Entry