CVE-2026-81090

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.

Score

CVSS 3.1 7.2 High

Status

Deferred - contact@wpscan.com

Published

2026-09-12

Last modified

2026-09-12

Weaknesses

CWE-352, CWE-434

Affected products

• Gpx2graphics (Unknown)

References

• https://wpscan.com/vulnerability/92e50025-cfa4-4727-bd02-8f45196021ae/