Skip to content
Sign in
8.8 High

CVE-2026-16985 The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data…

Description

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.

Affected products and versions

Product Affected versions Fixed in
Squeeze 1.7 earliest → < 1.7.12 1.7.12

Other CVEs of Squeeze

The 2 CVEs of Squeeze →
CVE-2026-110029 The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing… 5.4 Medium
Track this CVE