AskAny (< 2.2.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/askany--2.2.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:59:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAskAny WordPress plugin: Arbitrary file upload remote code execution (CVE-2026-121497)https://feed.craftedsignal.io/briefs/2026-11-askany-rce-cve-2026-121497/Wed, 11 Nov 2026 13:59:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-askany-rce-cve-2026-121497/The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type. This allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled.criticaladvisory