CVE-2026-16985
Received Received - Intake

Squeeze WordPress Plugin PHP File Upload RCE

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-16985
EUVD
EUVD-2026-55014

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the_squeeze wordpress_plugin to 1.7.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Squeeze WordPress plugin before version 1.7.12 has a flaw where it does not properly check file types or extensions when handling per-size image data in an attachment-update action. This allows users with upload capabilities, such as Authors, to upload executable PHP files into the uploads directory, potentially leading to remote code execution.

Detection Guidance

Check if the Squeeze WordPress plugin version is below 1.7.12. Inspect the uploads directory for unexpected PHP files or unusual file types. Review server logs for unauthorized file uploads or suspicious activity from users with Author privileges or higher.

Impact Analysis

If exploited, this vulnerability could allow attackers with Author-level access or higher to upload and execute malicious PHP files on your WordPress site. This could lead to full control over your website, data theft, or further compromise of your server.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR by exposing personal data or HIPAA by compromising protected health information. Compliance failures may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the Squeeze WordPress plugin to version 1.7.12 or later immediately. Remove any unauthorized PHP files from the uploads directory. Restrict file upload permissions to only necessary users and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16985. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart