CVE-2026-28133: 
WordPress vulnerability analysis and mitigation

CVE-2026-28133 is an Unrestricted File Upload vulnerability (CWE-434) in the WP Chill Filr WordPress plugin (filr-protection) that allows low-privileged authenticated attackers to upload web shells to the web server. The vulnerability was first reported by Patchstack on March 5, 2026, and affects Filr versions up to and including 1.2.14 (initially disclosed as affecting through 1.2.12, later updated). It carries a CVSS v3.1 base score of 8.5 (High), assigned by Patchstack (NVD, Patchstack).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), meaning the plugin's file upload functionality fails to adequately validate or restrict the types of files that authenticated users may upload. An attacker with low-level privileges can craft a request to upload a file with a dangerous extension (e.g., .php) that the web server will subsequently execute as server-side code. The attack vector is network-based, requires low privileges, no user interaction, and has high attack complexity, with scope change indicating impact beyond the vulnerable component itself (NVD, Patchstack).

Successful exploitation allows an attacker to upload and execute a web shell on the affected WordPress server, resulting in arbitrary remote code execution. This leads to complete compromise of confidentiality, integrity, and availability of the server — including potential access to sensitive data (database credentials, user data), modification or deletion of files, and disruption of service. The changed scope in the CVSS vector indicates that exploitation can affect resources beyond the plugin itself, enabling lateral movement within the hosting environment (NVD, Feedly).

As of the available data, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation of CVE-2026-28133. The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (NVD, Feedly).

1. Reconnaissance: Identify WordPress sites running the Filr plugin (filr-protection) version ≤ 1.2.14 using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Authentication: Obtain or register a low-privileged account (e.g., subscriber or contributor) on the target WordPress site.
3. Locate upload endpoint: Navigate to the Filr plugin's file upload functionality within the WordPress interface or identify the relevant REST/AJAX endpoint used by the plugin for file uploads.
4. Craft malicious payload: Prepare a PHP web shell file (e.g., shell.php) containing code such as <?php system($_GET['cmd']); ?>.
5. Upload web shell: Submit the malicious file via the plugin's upload mechanism, bypassing insufficient file type validation.
6. Execute arbitrary commands: Access the uploaded web shell via its URL on the server (e.g., https://target.com/wp-content/uploads/filr/shell.php?cmd=id) to achieve remote code execution and further compromise the server (NVD, Patchstack).

• File System: Presence of unexpected .php files (or other executable scripts) in the Filr plugin upload directory (e.g., wp-content/uploads/filr/ or similar); files with names like shell.php, cmd.php, or obfuscated names.
• Logs: WordPress access logs showing POST requests to Filr plugin upload endpoints followed by GET requests to newly created .php files in upload directories; unusual HTTP 200 responses for PHP files in upload folders.
• Network: Outbound connections from the web server process to unknown external IPs shortly after a file upload event; unusual DNS lookups or reverse shell traffic originating from the web server.
• Process: Unexpected child processes spawned by the web server (e.g., Apache/Nginx/PHP-FPM) such as bash, sh, curl, wget, or python executing system commands.

No official patch version has been confirmed in the available data; organizations should check the WordPress plugin repository for an updated version of the Filr plugin beyond 1.2.14. As immediate workarounds: disable or deactivate the Filr plugin until a patch is available; implement server-level restrictions to prevent execution of PHP files in upload directories (e.g., via .htaccess rules); enforce strict file type whitelisting at the web server or WAF level; and restrict plugin access to trusted users only, applying the principle of least privilege. Monitor upload directories for unexpected executable files (NVD, Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering the period of February 23 – March 1, 2026, highlighting it as part of broader WordPress plugin security concerns (Wordfence). The vulnerability was also noted by INCIBE-CERT (Spain's national cybersecurity incident response center) in their early warning alerts (INCIBE-CERT). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.