CriticalCritical vulnerability

CVE-2026-75799 (CVSS 9.0)

NVD · officialPublished Sep 23, 2026Risk 50/100EPSS 0.3%

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.

Technical details

CVSS

9.0

AV:NetworkAC:HighPR:NoneUI:NoneC:HighI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source