What is GHSA-qgr2-56q2-3f39?

GHSA-qgr2-56q2-3f39 is a security advisory published by GitHub Security Advisories with Critical severity. The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type...

Which CVE IDs does GHSA-qgr2-56q2-3f39 cover?

GHSA-qgr2-56q2-3f39 covers the following CVE IDs: CVE-2026-84171. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qgr2-56q2-3f39?

GHSA-qgr2-56q2-3f39 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-qgr2-56q2-3f39CriticalCVSS 9.8

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type...

Vendor

GitHub Security Advisories

Published

September 12, 2026

Last Modified

September 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-84171 →

📋 Description

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-84171
https://wpscan.com/vulnerability/e5b9fd87-92a7-4fc6-b8b2-896b87d97c40
https://github.com/advisories/GHSA-qgr2-56q2-3f39