CSRF-to-RCE File Upload Flaw in Gpx2Graphics Plugin

Executive Summary

A high-severity CSRF-to-RCE vulnerability (CVE-2026-81090) has been disclosed in the Gpx2Graphics WordPress plugin. The plugin performs no CSRF check on its file upload handler and does not validate uploaded file types, allowing an attacker to trick a logged-in administrator into unknowingly uploading an arbitrary file — including a PHP webshell — simply by getting them to visit a malicious page.

CVSS Score: 7.2 (High)

Unlike a directly unauthenticated upload flaw, this one requires social engineering an administrator, which lowers its severity slightly but keeps the end result identical: remote code execution.

Vulnerability Overview

Affected Versions

Attack Vector

1. Attacker crafts a malicious HTML page containing an auto-submitting
   form targeting the Gpx2Graphics upload endpoint
2. Attacker lures a logged-in WordPress administrator into visiting the
   page (phishing link, malicious ad, compromised site, etc.)
3. Victim's browser submits the forged request using their authenticated
   session — no CSRF token required
4. Plugin accepts the upload without validating file type or extension
5. Malicious PHP file is written to a web-accessible directory
6. Attacker accesses the uploaded webshell via HTTP — full RCE

Impact of Successful Exploitation

This maps to MITRE ATT&CK T1189 (Drive-by Compromise) / T1204 (User Execution) for delivery, and T1059 (web shell execution) for the payload.

Immediate Remediation

Step 1: Check for a Patch

No fixed version was available at time of disclosure. Monitor the plugin's WordPress.org page or WPScan advisory.

wp plugin get gpx2graphics --field=version

Step 2: Reduce Exposure

1. Deactivate Gpx2Graphics until a patch is released
2. Train administrators to avoid clicking unsolicited links while logged into WordPress
3. Consider requiring re-authentication for sensitive admin actions (e.g. via a security plugin that adds nonce-independent CSRF protection)

Step 3: Scan for Existing Compromise

# Search for recently uploaded PHP files in unexpected locations
find /path/to/wordpress/wp-content/ -name "*.php" -newer /path/to/wordpress/wp-includes/version.php -type f
 
# Verify WordPress core integrity
wp core verify-checksums

Post-Remediation Steps

1. Apply the vendor patch once released, or remove the plugin
2. Scan the installation for webshells uploaded during the exposure window
3. Rotate WordPress admin credentials and session cookies as a precaution
4. Log out all active admin sessions to invalidate any hijacked sessions
5. Deploy a WAF to catch PHP uploads to unexpected directories

References

• OffSeq Threat Radar — CVE-2026-81090 CWE-434 Unrestricted Upload of File with Dangerous Type in Gpx2Graphics
• VulDB — CVE-2026-81090 in Gpx2Graphics Plugin
• NIST NVD — CVE-2026-81090

Related Reading

• DS Ad Rotator Plugin Flaw Allows Unauthenticated RCE on WordPress
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+