CVE-2026-4808: 
WordPress vulnerability analysis and mitigation

CVE-2026-4808 is an arbitrary file upload vulnerability in the Gerador de Certificados – DevApps plugin for WordPress, caused by missing file type validation in the moveUploadedFile() function. It affects all plugin versions up to and including 1.3.6, and was published on April 8, 2026. The vulnerability carries a CVSS v3.1 base score of 7.2 (High), requiring authenticated Administrator-level access to exploit (Wordfence, Red Hat CVE).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The moveUploadedFile() function in admin/class-devapps-certificate-generator-admin.php (line 346) does not validate or restrict the file type of uploaded content, allowing an attacker with Administrator-level credentials to upload arbitrary files — including PHP web shells — directly to the server (Wordfence, WordPress Trac). The attack vector is network-based, requires no user interaction, and has low attack complexity once administrator credentials are obtained.

Successful exploitation enables an authenticated administrator to upload malicious files (e.g., PHP web shells) to the WordPress server, potentially achieving remote code execution (RCE). This can result in full compromise of the hosting environment, including high impacts to confidentiality, integrity, and availability. An attacker with RCE capability could exfiltrate sensitive data, modify site content, establish persistence, or pivot to other systems on the same hosting infrastructure (Wordfence, Red Hat CVE).

Exploitation requires authenticated Administrator-level access, which limits opportunistic exploitation but does not eliminate risk in scenarios involving compromised admin credentials, insider threats, or privilege escalation chains. The EPSS score is approximately 0.315%, indicating a relatively low (but non-zero) probability of exploitation in the wild. No public PoC exploit code, active in-the-wild exploitation, or CISA KEV catalog listing has been reported as of the available data (Wordfence).

1. Obtain Administrator Credentials: Acquire valid WordPress administrator credentials via phishing, credential stuffing, brute force, or a separate vulnerability.
2. Log in to WordPress Admin Panel: Authenticate to the target WordPress site's admin dashboard (/wp-admin).
3. Navigate to Plugin Functionality: Access the Gerador de Certificados – DevApps plugin's admin interface, which exposes the file upload feature backed by the vulnerable moveUploadedFile() function.
4. Upload Malicious File: Submit a crafted HTTP POST request (or use the plugin's UI) to upload a PHP web shell (e.g., shell.php) without any file type restriction being enforced by the plugin.
5. Locate Uploaded File: Identify the upload destination directory on the server (typically within the WordPress uploads or plugin directory).
6. Execute Web Shell: Access the uploaded PHP file via the web server (e.g., https://target.com/wp-content/uploads/shell.php) to achieve remote code execution and full server control (Wordfence, WordPress Trac).

• Network: Unexpected HTTP POST requests to WordPress admin endpoints associated with the Gerador de Certificados plugin containing non-image/document file uploads; outbound connections from the web server to unknown external IPs following file upload activity.
• File System: Presence of .php files in WordPress upload directories (e.g., wp-content/uploads/) or plugin directories that are not part of the original plugin installation; files with web shell signatures (e.g., eval, base64_decode, system, passthru in PHP files).
• Logs: WordPress access logs showing POST requests to plugin admin pages followed by GET requests to newly created .php files in upload directories; server error logs indicating PHP execution from unexpected paths.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx spawning bash, curl, wget, or python processes).

Update the Gerador de Certificados – DevApps plugin to version 1.3.7 or later, which addresses the missing file type validation in moveUploadedFile(). As an interim measure, restrict access to the WordPress admin panel using IP allowlisting or multi-factor authentication to reduce the risk of unauthorized administrator access. Site owners should also audit existing uploaded files for unexpected PHP or executable content (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for April 6–12, 2026, noting it as part of routine plugin security monitoring (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregator reporting has been identified.