Description

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-12T06:16:27.137Z",
  "pubdate": "2026-09-12T06:16:27.137Z",
  "executiveSummary": "The piclect WordPress plugin, specifically in versions up to 1.0, is susceptible to an unauthenticated arbitrary file upload vulnerability.\nThis security flaw stems from a failure to validate file names, extensions, or MIME types prior to storing uploaded files within a publicly accessible server directory.\nThe vulnerability allows remote, unauthenticated attackers to upload malicious files, such as PHP scripts, directly to the web server.\nSuccessful exploitation enables remote code execution (RCE), which grants the attacker the ability to execute arbitrary commands, compromise the host server, access sensitive database information, or gain full control over the WordPress installation.\nGiven that the vulnerability does not require prior authentication or elevated privileges, the risk is classified as critical.\nPublic exposure of the upload directory facilitates immediate execution of malicious payloads, posing a severe threat to the confidentiality, integrity, and availability of the affected WordPress environment.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of server-side validation logic within the file upload mechanism of the piclect plugin. The application fails to inspect the 'name' or 'type' attributes of incoming file requests before performing a write operation to the filesystem.\nWhen a user submits a file, the plugin processes the request without enforcing a whitelist of permitted file extensions (e.g., .jpg, .png) or validating the content type of the uploaded entity. Consequently, the server accepts any file type, including executable scripts such as .php, .phtml, or .phar files.\nThe attack flow begins when an unauthenticated actor sends a specially crafted POST request containing a malicious payload to the endpoint handled by the piclect plugin. Because the plugin lacks necessary authentication or authorization checks, the request is processed automatically.\nThe server writes the malicious file to a directory that is accessible via the web root. Once the file is written, the attacker can trigger the execution of the payload simply by navigating their browser to the URL path of the uploaded file. Upon navigation, the web server interprets the uploaded script, executing the embedded code with the privileges of the web server user (typically 'www-data' or similar).\nPost-exploitation impact is severe, as the attacker gains the ability to interact with the underlying operating system. This includes the potential to upload web shells, pivot into internal networks, modify WordPress configuration files, extract administrative credentials, or initiate ransomware attacks. Since the vulnerability resides within the plugin's core handling of user input, it remains active as long as the plugin is installed and reachable via the web interface. There are no requirements for specialized knowledge or complex bypass techniques, as the upload process is essentially wide open to any arbitrary file submission."
}