Skip to content
Sign in
10.0 Critical

CVE-2026-14560 The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a…

Description

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

Affected products and versions

Product Affected versions Fixed in
teddy-bear-customize-addon 1.0 earliest → 1.0.5 No fix stated

Other CVEs of teddy-bear-customize-addon

The 3 CVEs of teddy-bear-customize-addon →
CVE-2026-14562 The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks… 5.3 Medium CVE-2026-14559 The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating… 9.8 Critical
Track this CVE