External risk intelligence

WordPress Plugin Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-14560

The vulnerability affects a WordPress plugin, which is a common type of web application component. WordPress sites are frequently deployed as public-facing web services, making the plugin's file upload functionality reachable from the internet in standard deployment patterns.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical security vulnerability in a WordPress plugin that allows for website customization. The flaw enables unauthenticated attackers to upload and execute malicious code on the server, potentially leading to a complete compromise of the website. The primary concern is to confirm if this plugin is in use and assess any potential exposure.

Website customization plugin has a critical flaw.
Unauthenticated attackers can run code on servers.
Confirm if plugin is used and assess risk.

Attack Path

How an attacker could exploit the issue

An attacker can upload and execute arbitrary PHP files on a WordPress website by exploiting a flaw in the teddy-bear-customize-addon plugin. This happens because the plugin does not properly check the type of files being uploaded, instead trusting the client and keeping the original file name. An unauthenticated user can leverage this vulnerability to gain code execution capabilities on the server, which could be used to compromise the entire site.

No authentication required.
Uploading a malicious PHP file.
Server-side code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could upload arbitrary PHP files to a WordPress server, enabling them to execute code remotely. This could impact the integrity and availability of the server and any data it processes.

Server-side code execution.
Arbitrary PHP file uploads.
Compromised server integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the teddy-bear-customize-addon WordPress plugin allows for arbitrary file uploads, posing a critical risk to any WordPress site utilizing it. Ownership likely falls to the application owner or webmaster responsible for the WordPress instance, supported by the infrastructure or platform team managing the web server. The immediate first step is to identify all WordPress sites, locate this specific plugin, assess its reachability and business criticality, and then coordinate remediation with the responsible parties.

Application owners should manage this issue.
Verify plugin presence and reachability.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the teddy-bear-customize-addon plugin?

This is a WordPress plugin designed to help users modify or personalize their website's appearance. Like many WordPress components, it integrates directly into the site's back-end infrastructure to handle specific customization tasks, which requires it to process user-provided data and files.

What does CWE-94 mean for CVE-2026-14560?

CWE-94 refers to improper control of generation of code, often called code injection. In the context of this CVE, the plugin fails to verify the content of uploaded files. Because it trusts the user-provided file type and name, an attacker can upload a malicious script that the server then treats as legitimate executable code.

How do attackers trigger this vulnerability?

An attacker triggers this by uploading a malicious PHP file through the plugin's file upload feature. The flaw is that the plugin does not inspect the actual file contents, so it does not distinguish between a safe image and a dangerous script. Simply viewing or browsing the site without initiating a file upload does not trigger the bug.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as likely relevant because WordPress plugins are typically deployed on public-facing web services. If your site uses this plugin and is accessible from the internet, the upload feature is reachable by unauthenticated users, increasing the likelihood that an attacker could attempt to exploit the server.

How should I respond to this security flaw?

Begin by auditing your WordPress installations to see if the teddy-bear-customize-addon plugin is currently active. If found, evaluate the site's accessibility and importance to your operations. Coordinate with your web team to verify the plugin's presence and determine the best path forward, such as disabling the plugin or removing it entirely until a secure update is available.

References

wpscan.com/vulnerability/aba51906-91dc-4e75-ad44-373fe128deee/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.