CVE-2026-66665 CRITICAL

CVE-2026-66665: WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Vendor Brandexponents

Product Type Hub

Weakness CWE-434 · Unrestricted file upload

Published August 6, 2026

Last update August 6, 2026

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Type Hub versions up to 2.0.6 allow unauthenticated attackers to upload files of dangerous types without restriction. An attacker can upload executable code or malicious files directly to the server over the network. This vulnerability affects the entire system and can lead to complete compromise, including data theft, site defacement, and service disruption.

What an attacker can do

03Attacker Capabilities

Upload and execute malicious files on the server without authentication.

Potential impact on your site

04Site Impact

Complete system compromise: attackers can run code, steal data, deface content, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 6, 2026 CVE published

August 6, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-66665 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html AskarLabs — CWE-434 write-up Unrestricted Upload of File with Dangerous Type

Related vulnerabilities