7.5
High
CVE-2026-6101 The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to…
Description
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, and permissions granted by an Administrator, to write arbitrary files to the server in a web-accessible location, potentially leading to remote code execution on hosts that execute PHP files in the uploads directory.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| AMP for WP – Accelerated Mobile Pages 1.1 | earliest → 1.1.12 | No fix stated |
Other CVEs of AMP for WP – Accelerated Mobile Pages
The 12 CVEs of AMP for WP – Accelerated Mobile Pages →
CVE-2026-103908
AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info
5.4
Medium
CVE-2026-97019
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
7.2
High
CVE-2026-83591
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
7.2
High
CVE-2026-0627
The AMP for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up…
6.4
Medium