WordPress Plugin Arbitrary File Upload via Insufficient Validation

The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The mView 豆瓣电影 WordPress plugin through version 1.0.3 contains a critical arbitrary file upload vulnerability that allows authenticated users—including low-privilege subscribers—to bypass file type validation and upload malicious PHP files to web-accessible directories. The vulnerability stems from the plugin's failure to validate file types, names, or sources before saving remotely fetched files, combined with missing authorization checks. This is particularly dangerous because it reduces the barrier to exploitation; an attacker with even basic WordPress account access can execute arbitrary code on the server with web server privileges. Any WordPress installation using this plugin becomes an immediate target for lateral movement, data exfiltration, or use as a staging point for further attacks.

Casky's 447 matched security skills leverage Claude AI's extended reasoning to correlate this vulnerability across the MITRE ATT&CK framework's initial access (TA0001), persistence (TA0043), and execution (TA0002) tactics. Practitioners using Casky would identify detection patterns including: unauthorized file creation events in web-accessible directories with PHP extensions, anomalous plugin behavior patterns inconsistent with legitimate Douban integration, and subprocess spawning from web server processes—hallmarks of post-exploitation activity. The platform's skill mapping would surface that CWE-434 (Unrestricted Upload of File with Dangerous Type) chaining with authentication bypass techniques creates a particularly high-fidelity attack signature. Security teams would see findings highlighting the progression from low-privilege account exploitation through code execution, enabling faster incident response and threat hunting across their WordPress infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-115212.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-115212

Casky has 447 skills that investigate the attack patterns behind CVE-2026-115212. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn