Junglewise Threat Intelligence

CVE-2026-6101: AMP for WP arbitrary file write in ampforwp_save_local_font

CVE-2026-6101 · Severity: high · CVSS 7.5 · Published 2026-07-07

Executive brief

A popular WordPress plugin used to create mobile-optimized versions of websites is vulnerable to a security flaw that allows certain authorized users to upload malicious files. If an attacker has at least 'Author' level access and specific administrative permissions, they can place files in web-accessible folders on the server. This could allow them to take full control of the website or execute unauthorized code, potentially compromising customer data and site operations.

Technical details

The vulnerability is classified as an Arbitrary File Write (CWE-73) within the ampforwp_save_local_font() function. It stems from unsafe ZIP file extraction combined with a failure to properly clean up nested directories and files during the process. An authenticated attacker with Author-level privileges or higher, who has also been granted specific permissions by an Administrator, can exploit this to write arbitrary files to web-accessible locations. On servers where PHP execution is permitted in the uploads directory, this can lead to Remote Code Execution (RCE). The issue was addressed in a changeset following version 1.1.12.

Affected products

  • mohammed_kaludi AMP for WP – Accelerated Mobile Pages up to and including 1.1.12

Timeline

  • 2026-07-07: disclosed
  • 2026-07-07: advisory

References