CVE-2026-32559 CRITICAL

CVE-2026-32559: WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Vendor Tophive

Product UltimateAI

Weakness CWE-434 · Unrestricted file upload

Published August 24, 2026

Last update August 27, 2026

View on NVD All CVEs

CVSS base score

9.9/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

UltimateAI versions up to 3.1.0 allow authenticated users to upload files without proper type validation. An attacker with low-level access can upload malicious files—such as executable scripts—that execute on the server. This grants the attacker full control over the site, including the ability to read, modify, or delete data, and disrupt service.

What an attacker can do

03Attacker Capabilities

Upload and execute malicious files on the server to gain full control of the site.

Potential impact on your site

04Site Impact

A compromised site can have all data stolen, modified, or deleted, and service disrupted.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site.

Key dates

06Disclosure timeline

August 24, 2026 CVE published

August 27, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-32559 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html AskarLabs — CWE-434 write-up Unrestricted Upload of File with Dangerous Type

Related vulnerabilities