Critical RCE in AF Companion WordPress Plugin (CVE-2026-84738)

Executive Summary

A critical unrestricted file upload vulnerability (CVE-2026-84738) has been disclosed in AF Companion, a WordPress plugin. Versions before 2.2.0 fail to validate the type of files submitted through one of the plugin's import features, allowing any authenticated user holding the low-privileged store-management role to upload arbitrary files — including executable PHP — leading to full Remote Code Execution.

CVSS Score: 9.1 (Critical)

Because store-management is a low-tier role typically handed out to shop staff, contractors, or third-party integrators rather than site administrators, this flaw turns a routine "give the store clerk an account" decision into a full server-compromise risk.

Vulnerability Overview

Root Cause

The plugin's import functionality accepts uploaded files without checking their MIME type or file extension. Any user who can reach that import feature — which only requires the store-management role, not administrator access — can submit a .php file instead of the expected import format. Once written to a web-accessible directory, the file can be requested directly over HTTP, handing the attacker a webshell and code execution on the underlying server.

Affected Versions

Attack Vector

1. Attacker obtains or compromises a low-privileged store-management account
2. Attacker navigates to the AF Companion import feature
3. Attacker uploads a crafted file with a .php extension instead of a valid import file
4. Plugin writes the file to a web-accessible location without type validation
5. Attacker requests the uploaded file directly via HTTP
6. PHP webshell executes, granting the attacker code execution on the server

Impact of Successful Exploitation

Remediation

Step 1: Update Immediately

# Via WP-CLI
wp plugin update af-companion
 
# Verify the installed version
wp plugin get af-companion --field=version

Or update through Plugins > Installed Plugins > AF Companion > Update Now in the WordPress admin dashboard.

Step 2: Audit Store-Management Accounts

Since exploitation only requires the low-privileged role, review every account holding store-management access:

1. Remove or downgrade unused store-management accounts
2. Confirm third-party integrators and contractors still need the role
3. Rotate credentials for any account you cannot fully account for

Step 3: Scan for Existing Compromise

# Look for recently written PHP files outside expected plugin/theme paths
find /path/to/wordpress/wp-content/ -name "*.php" -newer /path/to/wordpress/wp-includes/version.php -type f
 
# Check for common webshell signatures
grep -rl "eval\s*(base64_decode" /path/to/wordpress/wp-content/
grep -rl "system\s*(" /path/to/wordpress/wp-content/uploads/
 
# Verify WordPress core integrity
wp core verify-checksums

If Immediate Patching Is Not Possible

1. Disable the AF Companion import feature if it can be turned off
2. Deactivate the plugin entirely until the update can be applied
3. Restrict store-management role creation to trusted administrators only
4. Deploy a WAF rule blocking .php uploads through the plugin's import endpoint

Detection Indicators

References

• VulDB — CVE-2026-84738
• Strix — CVE-2026-84738: AF Companion Code Injection
• NIST NVD — CVE-2026-84738