Cpe:2.3:a:yaycommerce:yaysmtp:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ayaycommerceyaysmtpwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 08:25:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary File Upload Vulnerability in YaySMTP WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-92553/Fri, 16 Oct 2026 08:25:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-92553/The YaySMTP WordPress plugin (<= 2.7.7) is vulnerable to arbitrary file upload due to insufficient validation in the putFile function, allowing authenticated users to achieve remote code execution.The YaySMTP - WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress (versions up to and including 2.7.7) contains a critical arbitrary file upload vulnerability within its putFile function. The flaw stems from improper file type validation, as the plugin fails to utilize an allow-list, perform MIME-type checking, or sanitize executable file extensions via the existing sanitize_file_name() function. While the developer attempted to implement a security guard via a .htaccess file generated by writeGuards(), this mechanism is ineffective on nginx servers and Apache configurations where AllowOverride is set to None. Consequently, an authenticated attacker with subscriber-level access or higher can upload arbitrary files, including web shells, to the WordPress environment, resulting in full remote code execution (RCE). The vulnerability is tracked as CVE-2026-92553.

Impact

Successful exploitation allows authenticated users with minimal privileges to gain complete control over the affected WordPress installation. This impact is significant for environments running on nginx or restricted Apache configurations, as the intended security measures are bypassed. Unauthorized code execution can lead to data exfiltration, defacement, or persistent access to the underlying web server infrastructure.

Recommendation

  • Immediately update the YaySMTP plugin to the latest version that patches CVE-2026-92553.
  • Audit web server configurations to ensure that file upload directories are prevented from executing scripts by default.
  • Monitor WordPress authentication logs for suspicious subscriber-level activity or unusual file creation patterns within the plugin's upload directories.
  • Configure security policies to disallow direct execution of uploaded content in directories managed by plugins.
]]>highadvisory