{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/askany--2.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-121497"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AskAny (\u003c 2.2.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"","date_modified":"2026-11-11T13:59:27Z","date_published":"2026-11-11T13:59:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-askany-rce-cve-2026-121497/","summary":"The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type. This allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled.","title":"AskAny WordPress plugin: Arbitrary file upload remote code execution (CVE-2026-121497)","url":"https://feed.craftedsignal.io/briefs/2026-11-askany-rce-cve-2026-121497/"}],"language":"en","title":"CraftedSignal Threat Feed - AskAny (\u003c 2.2.0)","version":"https://jsonfeed.org/version/1.1"}