Quick answers
- Is CVE-2026-14560 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14560 being exploited in the wild.
- How severe is CVE-2026-14560?
- Critical severity, with a CVSS score of 10, published 11 September 2026.
- Which products and versions are affected?
- Wordpress Teddy Bear Customize Addon through 1.0.5.
- Is there a fix for CVE-2026-14560?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-14560 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14560?
- Check whether you run Wordpress Teddy Bear Customize Addon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a classic arbitrary file upload vulnerability (CWE-94) in the plugin's file upload handler. The plugin relies solely on client-supplied content type headers and preserves the original filename without proper validation or filtering. This allows unauthenticated attackers to bypass security controls by uploading PHP files with spoofed MIME types. No authentication is required; the upload endpoint is publicly accessible. Successful exploitation results in remote code execution with web server privileges. There is no known patch as of the advisory date.
Affected products
- WordPress Teddy Bear Customize Addon through 1.0.5
Timeline
- 2026-09-09: disclosed
- 2026-09-11: advisory