External risk intelligence

Webinfos WordPress Plugin Arbitrary File Upload Leading to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-12872

The vulnerability affects a WordPress plugin and allows unauthenticated file uploads to a web-accessible directory. WordPress sites are frequently public-facing web applications, and this flaw specifically targets a pre-authentication endpoint, making it highly accessible via the public internet.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in a WordPress plugin, the Webinfos plugin, which could allow unauthorized individuals to upload malicious files to a website. This could potentially lead to the execution of arbitrary code on affected servers, posing a risk to website integrity and operations. The main concern is confirming relevance and exposure.

Allows unauthorized file uploads to websites.
Matters if WordPress sites use this plugin.
Verify plugin use; assess potential impact.

Attack Path

How an attacker could exploit the issue

An attacker can upload malicious files to a WordPress site without needing to log in. This is possible because the plugin does not properly check uploaded files. If the server runs PHP files from its upload directory, the attacker could execute arbitrary code remotely.

No login required.
Upload arbitrary files.
Remote code execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to upload arbitrary files, including executable PHP code, to a web server. When supported by the advisory, this could lead to the execution of that code on the server, potentially compromising its integrity and confidentiality.

Arbitrary file uploads to web directories.
Unauthenticated access to upload functionality.
Remote code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability likely impacts website owners and the teams managing their web infrastructure, such as application or platform teams. The first practical step is to identify all WordPress instances, confirm if the affected plugin is in use and accessible externally, and then determine the business criticality of those sites to prioritize remediation efforts with the accountable owner.

Ownership: Website and platform owners.
Verify first: Plugin presence and external reachability.
Action: Plan and execute remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Webinfos WordPress plugin?

Webinfos is a plugin designed for WordPress sites, typically used to provide specific information or data display features. Because it integrates directly into the WordPress ecosystem, it operates within the server's file structure, which is where this security flaw resides.

What does CWE-434 mean for CVE-2026-12872?

This vulnerability is classified as CWE-434, which refers to Unrestricted Upload of File with Dangerous Type. In simple terms, the plugin fails to check what kind of files are being uploaded. It acts like an unlocked door that lets anyone upload any file type, including malicious scripts, directly onto the web server.

Do I need to be logged in for an attacker to trigger this?

No. The vulnerability exists because the plugin lacks authentication, capability, or nonce checks. This means an attacker does not need an account or administrative access to upload files. Simply navigating to the specific endpoint used by the plugin is sufficient to initiate the upload process.

How do I know if my site is at risk?

According to Halo Surface Signal, this is highly relevant if your WordPress site is public-facing. Because the plugin processes uploads at a pre-authentication endpoint, the flaw is easily reachable via the internet. If your site is reachable from the public web and uses the Webinfos plugin, it is a primary target for this vulnerability.

How should I handle CVE-2026-12872?

Your first step is to inventory your web infrastructure to confirm if the Webinfos plugin is installed on any WordPress instances. If found, verify if those sites are accessible from the internet. Prioritize these sites for remediation based on their business importance while coordinating with the site owners to remove or secure the plugin.

References

wpscan.com/vulnerability/40e78256-6a84-44fc-b35b-26c21317691e/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.