CVE-2026-4808
Arbitrary File Upload in Gerador de Certificados Plugin Enables RCE
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| devapps | gerador_de_certificados | to 1.3.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Gerador de Certificados – DevApps plugin for WordPress has a vulnerability due to missing file type validation in its moveUploadedFile() function in all versions up to and including 1.3.6.
This flaw allows authenticated attackers with Administrator-level access or higher to upload arbitrary files to the affected site's server.
Because the plugin does not properly check the type of files being uploaded, attackers can potentially upload malicious files.
How can this vulnerability impact me? :
An attacker with Administrator-level access can exploit this vulnerability to upload arbitrary files, which may lead to remote code execution on the affected server.
This can compromise the security and integrity of the website and its underlying server, potentially allowing attackers to take control, steal data, or disrupt services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with Administrator-level access to upload arbitrary files, potentially leading to remote code execution on the affected server.
Such unauthorized file uploads and possible remote code execution can compromise the confidentiality, integrity, and availability of data, which are critical aspects of compliance with standards like GDPR and HIPAA.
Therefore, exploitation of this vulnerability could lead to violations of these regulations due to potential unauthorized access or data breaches.