External risk intelligence

AskAny WordPress Plugin File Upload Vulnerability Allows Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-121497

The vulnerability exists in a WordPress plugin that handles chat message attachments. WordPress sites are frequently deployed as public-facing web applications. Because the plugin allows unauthenticated users to interact with chat features and file uploads, the vulnerable surface is commonly accessible via the public internet as part of a standard website deployment.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the AskAny WordPress plugin that allows unauthenticated users to upload and execute PHP files, potentially leading to arbitrary code execution. This impacts the confidentiality, integrity, and availability of systems running this plugin without proper security configurations.

Allows unauthorized code execution via file uploads.
Critical for public-facing websites.
Confirm relevance; assess impact.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by uploading a malicious PHP file through the chat attachment feature of the AskAny WordPress plugin. Because the plugin does not properly validate file types, it allows unauthenticated users to upload these PHP files. When a visitor's attachment is enabled, the server will execute the uploaded PHP file, potentially leading to arbitrary code execution and full compromise of the website.

No authentication required.
Upload PHP file via chat attachments.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated users to upload and execute PHP files on a website when visitor attachments are enabled, potentially leading to the compromise of the website and its hosted data.

Website files and data at risk.
Unauthenticated users could upload PHP files.
Arbitrary code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The AskAny WordPress plugin's vulnerability to unauthenticated arbitrary code execution due to improper file upload validation primarily impacts website owners and potentially platform or infrastructure teams responsible for WordPress deployments. The immediate first step is to identify all WordPress instances using the AskAny plugin, confirm their exposure and business criticality, and then assign ownership for remediation.

Website owners should own the issue.
Verify plugin usage and exposure.
Plan vendor coordination for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the AskAny WordPress plugin?

AskAny is an add-on for WordPress websites designed to facilitate communication between site visitors and site operators. It provides a chat interface, often used for customer support or general inquiries, which includes functionality that allows users to send and receive file attachments during those chat sessions.

What does CWE-434 mean regarding CVE-2026-121497?

CWE-434 refers to an Unrestricted Upload of File with Dangerous Type. In this CVE, the plugin fails to verify the actual content or file extension of uploaded files. Instead of blocking prohibited formats, it relies solely on the browser's claim about the file type, which allows an attacker to disguise a malicious script as a harmless file.

How does an attacker trigger this vulnerability?

An attacker exploits this by utilizing the plugin's chat attachment feature to upload a PHP file. This vulnerability is only triggered when the 'visitor attachments' feature is enabled within the plugin settings. If this specific feature is disabled, the upload pathway that leads to code execution is not available.

Do I need to worry if my site is not public?

Halo Surface Signal indicates that because this plugin is designed for visitor interaction, it is typically deployed on public-facing websites where chat features are accessible to anyone on the internet. If your specific instance of AskAny is used only on an internal, private network, the risk is significantly lower than a public-facing site.

When should I take action for this vulnerability?

You should prioritize this immediately if you use AskAny. Your first step is to audit your WordPress environments to confirm if the plugin is installed and active. If it is, verify if visitor attachments are enabled. Consult the vendor's official channels to determine if a patched version is available, and plan your update process accordingly.

References

wpscan.com/vulnerability/e6aed436-10c6-403b-8d1a-0cf42f3e5aeb/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.