Critical severity9.8NVD Advisory· Published Sep 12, 2026· Updated Sep 14, 2026
CVE-2026-81402
CVE-2026-81402
Description
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=0.8
Patches
Vulnerability mechanics
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)Wordfence Blog · Sep 24, 2026