External risk intelligence

Advance Guest Post WordPress Plugin Unauthenticated Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-118064

The vulnerability affects a WordPress plugin designed for guest posts, which is intended to be accessed and used by public, unauthenticated front-end visitors. Because the plugin functionality is exposed directly to the public internet by design to allow user submissions, the vulnerable upload mechanism is inherently reachable from the internet in common deployments.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE describes a critical vulnerability in the Advance Guest Post WordPress plugin that allows unauthenticated users to upload and execute arbitrary PHP files on a web server. The issue stems from improper file upload validation and a nonce that is accessible to all visitors. While exploitation is dependent on the target running a specific version of PHP, the potential for remote code execution on affected systems is significant, requiring careful assessment of its relevance to your environment.

Unauthenticated users can upload and run malicious code.
Exploitation requires specific PHP versions, limiting broad risk.
Confirm relevance and exposure to understand potential impact.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can upload a malicious PHP file to a WordPress site running an older version of PHP by exploiting a flaw in the Advance Guest Post plugin's file upload handling. This allows them to execute arbitrary code on the server.

No authentication needed.
Upload arbitrary PHP files.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory and when the target runs PHP 7.x, this vulnerability could allow unauthenticated users to upload and execute arbitrary PHP files. This could impact the availability and integrity of the affected web server.

Server code execution.
Unauthenticated arbitrary file uploads.
Web server compromise and disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and security teams should prioritize identifying instances of the Advance Guest Post WordPress plugin, especially on PHP 7.x environments. The first practical step is to confirm the presence of the plugin, assess its exposure and criticality, and then coordinate remediation efforts with vendor management if necessary.

Plugin owners and platform teams.
Verify PHP version and plugin reachability.
Plan remediation or implement temporary controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Advance Guest Post plugin for WordPress?

Advance Guest Post is a WordPress plugin designed to allow website visitors to submit content directly to a site from the front-end. By enabling unauthenticated users to upload files and media for guest posts, the plugin creates a bridge for external content ingestion into the WordPress environment.

What does CWE-434 mean regarding CVE-2026-118064?

This vulnerability is classified as CWE-434, or Unrestricted Upload of File with Dangerous Type. It occurs when a program allows a user to upload files without sufficiently validating the file's content or extension. In this case, the plugin fails to properly check what is being uploaded, allowing malicious scripts to be saved and later executed by the server.

Does this vulnerability trigger on all servers?

No. The ability to execute the uploaded code depends on the server's PHP version. Exploitation is successful on systems running PHP 7.x. However, if the site runs PHP 8.0 or later, the vulnerable code path triggers a fatal error, which stops the file from being written and prevents the malicious code from running.

How does Halo Surface Signal categorize this threat?

Halo Surface Signal labels this as 'Very likely' to be relevant for most users. Because the plugin is designed for public guest submissions, its file upload functions are intentionally exposed to the internet. Since no authentication is required to access these upload features, the attack surface is inherently public-facing.

What steps should I take if I use this plugin?

First, inventory your WordPress sites to identify if the Advance Guest Post plugin is installed. Next, check your server's PHP version; environments on PHP 7.x are at the highest risk. If you cannot update to a secure PHP version or remove the plugin immediately, consider disabling the plugin or restricting access to the submission pages until a vendor update is available.

References

wpscan.com/vulnerability/897a812b-b84b-4422-9f3b-20402a0a8af5/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.