CVE-2026-57700: WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability

Synopsis

An unrestricted file upload vulnerability in the WordPress OMGF Pro plugin (versions up to and including 5.2.6) allows a remote, unauthenticated attacker to upload files of any type, including executable code, to the target server. The flaw is reachable over the network with no credentials and no victim interaction required, and carries a CVSS 10.0 critical score with scope change, meaning impact extends beyond the plugin itself. Successful exploitation gives an attacker full read access, write access, and the ability to crash or take over the underlying server, typically through a web shell uploaded via the vulnerable endpoint. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session token of any kind is needed to trigger the upload; the endpoint accepts unauthenticated requests.

• Victim interactionNot required

  The attacker operates entirely without user interaction; no administrator or visitor needs to click anything or visit a page.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental preconditions.

Blast Radius

• An attacker can upload an arbitrary executable file (such as a PHP web shell) and gain remote code execution on the host running WordPress.
• Full confidentiality impact means the attacker reads any data accessible to the web server process, including database credentials, configuration files, and stored user data.
• Full integrity impact means the attacker writes or overwrites any file accessible to the web server process, including core WordPress files and other plugins.
• Full availability impact with scope change means the attacker can crash or render the WordPress service and potentially other co-hosted services inoperable.