External risk intelligence

Anton Extensions WordPress Plugin Arbitrary File Upload Leading to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-104028

The vulnerability exists in a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications. Because the plugin allows unauthenticated file uploads, the attack surface is directly reachable via the internet as part of the standard web server functionality.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified in a WordPress plugin that could allow unauthorized users to upload malicious files to your website. This vulnerability, if exploited, could lead to the execution of arbitrary code, potentially impacting the integrity and availability of your web presence. The primary concern at this stage is to determine if this plugin is in use and assess any potential exposure.

Unauthenticated file uploads can lead to code execution.
It affects widely used website software.
Confirm if this plugin is used on any company websites.

Attack Path

How an attacker could exploit the issue

An attacker can upload arbitrary PHP files to a website by exploiting a weakness in the Anton Extensions WordPress plugin. This is possible because the plugin does not properly check user permissions or validate uploaded files before saving them. If successful, this could allow an attacker to execute their own code on the server.

Unauthenticated access to the website.
Uploading a malicious PHP file.
Remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to upload arbitrary PHP files to a WordPress site when the Anton Extensions plugin is installed. This could lead to the execution of malicious code on the server, potentially impacting the site's functionality and integrity.

Arbitrary PHP file uploads.
Unauthenticated attacker uploads files.
Remote code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Anton Extensions WordPress plugin requires immediate attention from the web application owner and security team. The first step is to identify all WordPress instances running this plugin, confirm their exposure to the internet, and assess their business criticality to prioritize remediation efforts.

Application owners should own the issue.
Verify plugin installation and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Anton Extensions plugin for WordPress?

Anton Extensions is a supplementary software component installed on WordPress websites to add specific, developer-defined features. Like many plugins, it extends the core platform's functionality to support custom site requirements. Because it resides within the WordPress environment, it operates with the same access levels as the web server, making it a critical part of the application's overall security architecture.

What does CWE-434 mean regarding CVE-2026-104028?

CWE-434 refers to an Unrestricted Upload of File with Dangerous Type. In the context of this CVE, it means the plugin fails to verify what kind of file is being uploaded or who is uploading it. Because the software does not filter for malicious content or check permissions, it allows users to save executable scripts—specifically PHP files—directly onto the server's file system, which the server may then run as part of the website's operations.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a crafted file upload request to the server without needing any login credentials or administrative permissions. The bug is not triggered by standard site navigation or legitimate user actions; it specifically requires the intentional submission of a malicious file through the plugin's exposed upload path. If the plugin's upload mechanism is not reachable or the input is properly validated, this specific attack path is blocked.

Is my website at risk from this vulnerability?

If you use this plugin, your risk depends on how your site is deployed. Halo Surface Signal identifies this as a high-risk scenario because WordPress sites are typically public-facing, meaning the vulnerable plugin is exposed to the internet. If your site is accessible to the public, an attacker anywhere can interact with the plugin's upload function. Internal or restricted sites may face lower immediate risk but remain vulnerable if the plugin is active.

How should I respond if I use Anton Extensions?

Begin by auditing your WordPress environments to inventory every instance where this plugin is currently installed. Once identified, evaluate whether the plugin is essential for business operations. If it is not required, uninstall it immediately to remove the attack vector. If you must keep it, isolate the affected site from public access until a security update is available to address the lack of file validation and permission checks.

References

wpscan.com/vulnerability/0be8a03e-d854-48db-bdc0-1beead3d7b91/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.