CVE-2026-14560
Received Received - Intake

File Upload Vulnerability in Teddy Bear Customize Addon WordPress Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: WPScan

Description
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-14560
EUVD
EUVD-2026-75959

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated arbitrary file upload vulnerability in the Teddy Bear Customize Addon WordPress plugin (version 1.0.5 or below). The plugin does not properly validate uploaded files, relying on client-supplied content types and preserving original filenames. This allows attackers to upload malicious PHP files that can be executed on the server to achieve remote code execution.

Detection Guidance

Check if the teddy-bear-customize-addon WordPress plugin version 1.0.5 or below is installed. Look for unexpected PHP files in upload directories. Review server logs for suspicious file uploads with client-supplied content types.

Impact Analysis

An attacker could exploit this to upload and execute arbitrary PHP code on your server, potentially taking full control of your WordPress site. This could lead to data theft, defacement, malware distribution, or further compromise of your server and network.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. Organizations may face fines, legal action, and reputational damage if exploited.

Mitigation Strategies

Immediately disable or uninstall the teddy-bear-customize-addon plugin if installed. Restrict file upload permissions on the server. Monitor for unauthorized PHP file executions. Apply temporary fixes if available from WordPress or plugin developers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14560. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart