CVE-2026-15039

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.

Score

CVSS 3.1 9.8 Critical

Status

Deferred - contact@wpscan.com

Published

2026-08-12

Last modified

2026-08-12

Weaknesses

CWE-434

Affected products

• Giftware (Unknown)

References

• https://wpscan.com/vulnerability/b7b3308c-430e-4bc3-a3df-da20d47cf314/