Description

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-09-23T06:17:01.710Z",
  "pubdate": "2026-09-23T06:17:01.710Z",
  "executiveSummary": "The YAHMAN Add-ons WordPress plugin prior to version 0.9.31 contains a critical vulnerability involving improper validation of remote file types during the caching process.\nThis flaw allows unauthenticated attackers to perform arbitrary file uploads, leading to Remote Code Execution (RCE) on the underlying server.\nBy bypassing file type restrictions, an attacker can store malicious PHP scripts within a publicly accessible directory, which the web server subsequently executes upon direct request.\nThe vulnerability represents a severe security risk, granting attackers complete control over the WordPress environment if the relevant plugin feature is enabled.\nExploitation requires no authentication, making this an attractive target for automated scanning and remote compromise.\nSystem administrators are urged to update to version 0.9.31 or higher to mitigate the risk of full server takeover.",
  "technicalDetails": "The root cause of the vulnerability lies in the plugin's file caching mechanism, which fails to verify the MIME type or file extension of resources fetched from remote locations.\nWhen the caching feature is active, the plugin retrieves remote files and saves them to a designated directory that is accessible via the web server's document root.\nBecause the plugin does not enforce strict validation on the content or nature of the downloaded files, an attacker can manipulate the request to fetch a specially crafted PHP file from an attacker-controlled external server.\nThe exploitation flow begins with the attacker identifying the caching functionality and supplying a URL pointing to a malicious PHP payload.\nThe plugin processes this request, fetches the payload from the remote server, and writes it to the local cache directory on the WordPress instance.\nSince the directory is publicly accessible, the attacker can then navigate to the path where the file was stored. Upon accessing this URL, the web server processes the uploaded file as a PHP script, leading to arbitrary code execution within the context of the web server user.\nThis vulnerability is classified as unauthenticated RCE, as it requires no prior credentials or administrative privileges to trigger the file write process.\nThe impact of a successful exploit is comprehensive; the attacker can gain persistent access, execute system-level commands, modify database content, exfiltrate sensitive information, or deploy additional backdoors for further post-exploitation activities.\nThe flaw affects all versions of YAHMAN Add-ons prior to 0.9.31, specifically targeting the logic responsible for handling external resource caching."
}