CRITICAL
9.8 CVE-2026-121497 Published 11 Nov 2026
AskAny WordPress Plugin Unrestricted File Upload Vulnerability
Worried this affects your website?
The AskAny WordPress plugin before version 2.2.0 contains a file upload vulnerability in chat message attachments.
The plugin does not validate the extension or content of uploaded files, instead trusting the browser-supplied file type.
- Affected versions: before 2.2.0
- Precondition: visitor attachments are enabled
- Impact: unauthenticated users can upload PHP files and execute arbitrary code
Reference: CVE-2026-121497 on NVD
← Back to Security News