CVE-2026-92553
Received Received - Intake

Arbitrary File Upload in YaySMTP WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does not strip executable extensions and no allow-list, MIME check, or safe-extension rename is applied. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The only server-side guard is a .htaccess file containing 'Require all denied' written by writeGuards(), which is silently ignored by nginx and by Apache configured with AllowOverride None, meaning RCE is fully achievable on those server configurations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-92553
EUVD
EUVD-2026-102789

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yaycommerce YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the YaySMTP WordPress plugin versions up to 2.7.7. It allows authenticated attackers with subscriber-level access or higher to upload potentially executable files due to insufficient file type validation in the putFile function. The plugin fails to block executable file extensions, and server-side protections like .htaccess are ineffective on certain configurations, enabling remote code execution.

Detection Guidance

Check for unauthorized file uploads in WordPress directories, especially files with executable extensions. Inspect server logs for suspicious activity from authenticated users with subscriber-level access or higher. Look for files outside standard WordPress directories or files with unexpected extensions.

Impact Analysis

If you use the vulnerable YaySMTP plugin, attackers could upload malicious files to your WordPress site. This could lead to remote code execution, allowing attackers to take control of your website, steal data, or install malware. The attack requires only subscriber-level access, making it easier for unauthorized users to exploit.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. A successful exploit may result in unauthorized data exposure, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Update the YaySMTP plugin to the latest version if available. Disable file uploads via the plugin if not required. Implement server-side file upload restrictions, such as strict MIME type checks and allow-lists for permitted file types. Review and restrict user roles with upload permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart