Junglewise Threat Intelligence

CVE-2026-2354: wpmessiah Swiss Toolkit For WP arbitrary file upload in upload_extension_files

CVE-2026-2354 · Severity: high · CVSS 8.8 · Published 2026-07-11

Executive brief

The Swiss Toolkit For WP, a WordPress plugin used for site management and optimization, contains a security flaw that allows users with Author-level access to upload malicious files to the server. If the plugin's 'Enhanced Multi-Format Image Support' feature is active, an attacker can bypass security checks to upload and execute code. This could lead to a full takeover of the website, data theft, or service disruption.

Technical details

The Swiss Toolkit For WP plugin suffers from an unrestricted file upload vulnerability (CWE-434) within the `upload_extension_files()` function. The root cause is a flawed validation logic that hooks into the `wp_check_filetype_and_ext` filter and uses `strpos()` to verify filenames against allowed extensions rather than checking the actual file extension. An authenticated attacker with Author-level privileges or higher can exploit this by including a permitted extension string (e.g., '.avif') anywhere in a malicious filename (e.g., 'shell.php.avif'). Successful exploitation requires the 'Enhanced Multi-Format Image Support' feature to be enabled and can lead to remote code execution.

Affected products

  • wpmessiah Swiss Toolkit For WP up to, and including, 1.4.6

Timeline

  • 2026-07-11: disclosed: NVD publication date

References