What the vulnerability does
01Description
The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wp_dispatcher_process_upload() function in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The directory does have an .htaccess file which limits the ability to achieve remote code execution.
Explanation of Vulnerability in Simple Terms
02Summary
WP Dispatcher versions 1.2.0 and earlier allow authenticated users to upload files without proper validation. An attacker with low-level site access can upload malicious files to gain control of the site. The vulnerability requires network access and some attack complexity, but no user interaction beyond the initial upload.
What an attacker can do
03Attacker Capabilities
Upload malicious files to execute code or compromise the site.
Potential impact on your site
04Site Impact
Compromised site with potential data theft, malware injection, or complete takeover by any authenticated user.
Conditions required to exploit
05Prerequisites
Attacker must have low-level authenticated access to the site.
Key dates
06Disclosure timeline
October 3, 2025
CVE published
April 8, 2026
Record updated
