Executive brief
WpStream is a WordPress plugin used for live streaming and video-on-demand services. A security flaw allows users with basic 'Subscriber' accounts to upload unauthorized files to the website. This could allow an attacker to place malicious scripts on the server, potentially leading to a full site takeover or disruption of services.
Technical details
The WpStream plugin for WordPress (versions prior to 4.11.2) contains an unrestricted file upload vulnerability (CWE-434). The flaw allows authenticated attackers with low-level 'Subscriber' privileges to upload arbitrary files to the server via the plugin's functionality. This occurs due to insufficient validation of file types and origins during the upload process. If an attacker successfully uploads a PHP script or other executable file, they may achieve remote code execution (RCE) or establish a persistent backdoor. The issue is resolved in version 4.11.2.
Affected products
- WpStream WpStream < 4.11.2
Timeline
- 2026-02-09: other: Vulnerability reported by Muhammad Sharief
- 2026-04-17: advisory: Patchstack published advisory
- 2026-06-15: disclosed: CVE published to NVD