CVE-2026-2354
Received Received - Intake

Arbitrary File Upload in Swiss Toolkit For WP Plugin

Publication date: 2026-07-11

Last updated on: 2026-07-11

Assigner: Wordfence

Description
The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()` function hooks into WordPress's `wp_check_filetype_and_ext` filter and uses `strpos()` to check if a filename contains a configured extension string, rather than verifying the actual file extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files (including PHP) on the affected site's server which may make remote code execution possible, granted the "Enhanced Multi-Format Image Support" feature is enabled with at least one extension (e.g., avif) in the allowed formats.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-11
Last Modified
2026-07-11
Generated
2026-07-11
AI Q&A
2026-07-11
EPSS Evaluated
N/A
NVD
CVE-2026-2354
EUVD
EUVD-2026-43133

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
swiss_toolkit swiss_toolkit_for_wp to 1.4.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Swiss Toolkit For WP plugin for WordPress has a vulnerability in its file upload functionality. Specifically, the function upload_extension_files() incorrectly validates file types by checking if a filename contains a configured extension string using strpos(), rather than properly verifying the actual file extension.

This flaw allows authenticated users with Author-level access or higher to bypass file type restrictions and upload arbitrary files, including potentially malicious PHP files, to the server.

If the "Enhanced Multi-Format Image Support" feature is enabled with at least one allowed extension (such as avif), this vulnerability could lead to remote code execution on the affected site.

Impact Analysis

This vulnerability can have severe impacts including unauthorized file uploads that may lead to remote code execution on the server hosting the WordPress site.

An attacker with Author-level access could exploit this to upload malicious scripts, potentially gaining control over the website, defacing content, stealing data, or using the server for further attacks.

The compromise could result in service disruption, data breaches, and damage to the website's reputation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2354. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart