CVE-2026-16250
Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload
- State
- Published
- Severity
- 9.8 Critical
- Published
- Aug 3, 2026
- Updated
- Aug 4, 2026
- Reserved
- Jul 20, 2026
Description
The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
Personal QR MessageUnknown |
|
References
- https://wpscan.com/vulnerability/05bd2683-ef3b-4816-a323-12d5e943612a/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.