What the vulnerability does
01Description
The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()` function hooks into WordPress's `wp_check_filetype_and_ext` filter and uses `strpos()` to check if a filename contains a configured extension string, rather than verifying the actual file extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files (including PHP) on the affected site's server which may make remote code execution possible, granted the "Enhanced Multi-Format Image Support" feature is enabled with at least one extension (e.g., avif) in the allowed formats.
Explanation of Vulnerability in Simple Terms
02Summary
Swiss Toolkit For WP versions up to 1.4.6 allow authenticated users to upload files without proper validation. An attacker with low-level site access can upload malicious files, potentially gaining full control of the site. This affects confidentiality, integrity, and availability of the WordPress installation.
What an attacker can do
03Attacker Capabilities
Upload malicious files to the site and execute arbitrary code with full site privileges.
Potential impact on your site
04Site Impact
Compromised site with potential data theft, malware injection, or complete takeover by an authenticated attacker.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege authenticated account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
July 11, 2026
CVE published
July 13, 2026
Record updated
