CVE-2026-19089: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2026-19089 is an unauthenticated arbitrary file upload vulnerability in the Product Input Fields for WooCommerce WordPress plugin that can lead to remote code execution (RCE). The flaw affects plugin versions from 2.0.0 up to (but not including) 2.0.2, and was publicly disclosed on August 7, 2026, with a patch released in version 2.0.2. The vulnerability was discovered and reported by researcher Farid Narimanov. A formal CVSS score has not yet been published, though Feedly estimates the severity as High (WPScan, GitHub Advisory).

The root cause is an absence of file type validation (CWE-434: Unrestricted Upload of File with Dangerous Type) when the plugin's accepted-types setting is left empty. The plugin's own documentation describes this empty configuration as "accepting all files," meaning the behavior is documented but the security implication — that executable files such as PHP scripts can be uploaded — is not restricted. An unauthenticated attacker can submit a crafted multipart file upload request to the plugin's file upload endpoint, placing a malicious file (e.g., a PHP web shell) in a web-accessible directory. RCE is achieved on servers that do not enforce execution restrictions on upload directories (WPScan, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to upload arbitrary files — including PHP web shells — to the server and execute arbitrary code in the context of the web server process. This can result in full compromise of the WordPress site, unauthorized access to the underlying server, theft of sensitive data (including database credentials stored in wp-config.php), and potential lateral movement within the hosting environment. The impact is conditional on the server not enforcing PHP execution restrictions in the uploads directory (WPScan).

No public proof-of-concept (PoC) exploit is currently available; WPScan has indicated the PoC will be disclosed on September 7, 2026, to allow time for users to update. There is no confirmed evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been made. The EPSS score is reported as 0.0, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the "Product Input Fields for WooCommerce" plugin (versions 2.0.0–2.0.1) using tools like WPScan, Shodan, or by inspecting plugin directories at /wp-content/plugins/product-input-fields-for-woocommerce/.
2. Identify upload endpoint: Locate a WooCommerce product page that uses a file upload input field rendered by the plugin, which is the publicly accessible upload mechanism.
3. Craft malicious upload: Prepare a PHP web shell file (e.g., shell.php) containing code such as <?php system($_GET['cmd']); ?>.
4. Submit upload request: Send a multipart HTTP POST request to the plugin's file upload handler with the PHP file as the payload. Because accepted-types is empty, no server-side file type validation is performed and the file is accepted.
5. Locate uploaded file: Determine the path of the uploaded file within the WordPress uploads directory (e.g., /wp-content/uploads/).
6. Execute arbitrary code: Access the uploaded shell via the browser (e.g., https://target.com/wp-content/uploads/shell.php?cmd=id) to achieve RCE on servers that permit PHP execution in the uploads directory (WPScan).

• Network: Unusual multipart POST requests to WooCommerce product pages or plugin-specific upload endpoints from unauthenticated (non-logged-in) sessions; subsequent GET requests to files with .php extensions within /wp-content/uploads/.
• File System: Unexpected .php files (especially with names like shell.php, cmd.php, or random strings) in /wp-content/uploads/ or subdirectories; recently modified files in the uploads directory with PHP content.
• Logs: Web server access logs showing POST requests to upload endpoints followed by GET requests to .php files in the uploads directory; HTTP 200 responses for PHP files in upload directories.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as bash, curl, wget, or network scanning tools.

The primary remediation is to upgrade the Product Input Fields for WooCommerce plugin to version 2.0.2 or later, which introduces proper file type validation (WPScan, GitHub Advisory). As an immediate workaround prior to patching, configure the plugin's accepted-types setting with an explicit whitelist of permitted file extensions (e.g., jpg,png,pdf) rather than leaving it empty. Additionally, harden the web server by adding an .htaccess rule or server configuration to deny PHP execution within the WordPress uploads directory (e.g., php_flag engine off in /wp-content/uploads/.htaccess). Web application firewalls (WAFs) can also be configured to block uploads of executable file types.

The vulnerability was discovered and responsibly disclosed by researcher Farid Narimanov, who submitted it to WPScan. WPScan has adopted a coordinated disclosure approach, withholding the full PoC until September 7, 2026, to provide a remediation window for site administrators (WPScan). No significant broader media coverage or notable community commentary beyond standard vulnerability database aggregation has been observed at this time.