https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:23:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291852 EUVD-2026-291852 https://cve.radiocsirt.org/vuln/euvd-2026-291852 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5427 <p>The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the &#39;kubio&#39; attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress&#39;s normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database.</p> <p>The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the &#39;kubio&#39; attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress&#39;s normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-5427 https://cve.radiocsirt.org/vuln/ghsa-69wp-qf6q-mf28 <p>The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the &#39;kubio&#39; attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress&#39;s normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database.</p> <p>The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the &#39;kubio&#39; attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress&#39;s normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database.</p> https://cve.radiocsirt.org/vuln/ghsa-69wp-qf6q-mf28