Vulnerability details

CVE-2026-81090

Gpx2Graphics

Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF

CVSS 3.1

7.2High

Official description

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.

CVSS scores

Score	Version	Source	Vector
7.2High	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
—	Gpx2Graphics	v ≤ 0.3	CVEProject cvelistV5 (CNA)

References and advisories

https://wpscan.com/vulnerability/92e50025-cfa4-4727-bd02-8f45196021ae/ exploitvdb-entrytechnical-description

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-12
Last updated: 2026-09-12
State: Published
Assigner (CNA): WPScan

Exploit prediction (EPSS)

0.37%

Probability of exploitation in 30 days

31.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-434
Unrestricted Upload of File with Dangerous Type
CWE-352
Cross-Site Request Forgery (CSRF)