CVE-2026-75799
Received Received - Intake

Unauthenticated Remote Code Execution in YAHMAN Add-ons WordPress Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-75799
EUVD
EUVD-2026-85024

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yahman add-ons_wordpress_plugin to 0.9.31 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the YAHMAN Add-ons WordPress plugin before version 0.9.31. It allows unauthenticated attackers to upload arbitrary PHP files to the server by exploiting improper validation of remote files cached in a publicly accessible directory. When the vulnerable feature is enabled, this can lead to Remote Code Execution (RCE).

Detection Guidance

Check if the YAHMAN Add-ons WordPress plugin version is below 0.9.31. Look for unauthorized PHP files in publicly accessible directories, especially those related to caching features. Monitor server logs for suspicious file uploads or execution attempts.

Impact Analysis

An attacker could exploit this to execute malicious code on your server, potentially taking control of your website or server. This could lead to data theft, defacement, or further attacks on your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the YAHMAN Add-ons WordPress plugin to version 0.9.31 or later. Disable the vulnerable caching feature if it is not required. Remove any unauthorized PHP files found in public directories and audit server access logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75799. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart