AF Companion Plugin Arbitrary File Upload to RCE

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The AF Companion WordPress plugin vulnerability (CVE-2026-84738) is a critical arbitrary file upload flaw that bypasses file type validation in its import feature. This allows attackers with store-management role privileges to upload malicious PHP files directly to the server, achieving Remote Code Execution with a CVSS score of 9.1. The vulnerability is particularly dangerous because it requires only low-privileged access rather than administrator credentials, significantly expanding the attack surface for WordPress sites using this plugin. Any organization relying on AF Companion for e-commerce or content management operations faces immediate risk of complete system compromise through uploaded webshells.

Casky's 323 matching security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this CVE across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Resource Development). Practitioners would observe detection findings related to CWE-94 (Improper Control of Generation of Code), identifying suspicious file upload requests that lack proper MIME-type validation and examining POST requests to the vulnerable import endpoint for executable payloads. Security teams would see skill activations flagging: (1) anomalous PHP file uploads through non-standard import channels, (2) file permission changes on newly created web-accessible PHP files, (3) execution of uploaded code through webshell patterns, and (4) privilege escalation attempts by store-management role users. By mapping these behavioral indicators to ATT&CK techniques, Casky enables practitioners to distinguish legitimate administrative uploads from exploitation attempts and prioritize remediation to plugin version 2.2.0 or later.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-84738.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-84738

Casky has 323 skills that investigate the attack patterns behind CVE-2026-84738. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn