CVE-2026-81090 Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF
Attackers can force logged-in administrators to upload arbitrary files, such as PHP scripts, leading to remote code execution via CSRF.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81090?
CVE-2026-81090 is a high-severity vulnerability in Unknown Gpx2Graphics, published on 12 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.
Which versions are affected by CVE-2026-81090?
How do I fix CVE-2026-81090?
No fix has been published for CVE-2026-81090 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81090 being exploited?
There is no known exploitation of CVE-2026-81090 in the wild and no public exploit code.
Sources
Also known as GHSA-58qj-rr2r-8rmm.