AMP for WP - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/amp-for-wp/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 07 Jul 2026 14:18:39 +0000CVE-2026-6101 — Arbitrary File Write in AMP for WP Plugin for WordPresshttps://feed.craftedsignal.io/briefs/2026-07-amp-for-wp-file-write/Tue, 07 Jul 2026 14:18:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-amp-for-wp-file-write/An arbitrary file write vulnerability (CVE-2026-6101) exists in the AMP for WP – Accelerated Mobile Pages plugin for WordPress, affecting versions up to and including 1.1.12. This flaw, caused by unsafe ZIP file extraction and inadequate cleanup, allows authenticated attackers with Author-level access and administrator-granted permissions to write arbitrary files to web-accessible server locations, potentially leading to remote code execution.The AMP for WP – Accelerated Mobile Pages plugin for WordPress, impacting versions up to and including 1.1.12, contains an arbitrary file write vulnerability, identified as CVE-2026-6101. This flaw stems from unsafe ZIP file extraction within the ampforwp_save_local_font() function, compounded by inadequate cleanup of nested directories and files. Exploitation requires authenticated attackers with Author-level access and administrator-granted permissions. Successful exploitation allows the attacker to write arbitrary files to web-accessible server locations, which can lead to remote code execution on the compromised WordPress instance. This vulnerability poses a significant risk to affected WordPress sites as it can lead to full system compromise.

Attack Chain

  1. An attacker gains authenticated access to a WordPress site with Author-level privileges.
  2. An Administrator grants the attacker permissions that allow the use of a plugin feature which invokes the ampforwp_save_local_font() function.
  3. The attacker crafts a specially designed ZIP archive containing malicious PHP webshell code, structured to exploit path traversal during extraction.
  4. The attacker uploads this crafted ZIP file via the vulnerable WordPress plugin functionality, triggering the ampforwp_save_local_font() function.
  5. Due to unsafe ZIP file extraction, the malicious PHP file is written to a web-accessible directory on the server, outside its intended location, and inadequate cleanup fails to remove it.
  6. The attacker subsequently accesses the newly written malicious PHP file through a direct web request, triggering its execution on the server.
  7. Successful execution of the malicious PHP file leads to remote code execution (RCE) on the underlying server, allowing arbitrary command execution and further system compromise.

Impact

Successful exploitation of CVE-2026-6101 grants authenticated attackers the ability to write arbitrary files to the web server, potentially leading to full remote code execution (RCE) on the WordPress instance. This can result in complete compromise of the website, including data theft, defacement, or further lateral movement within the hosting environment. While specific victim counts are not provided, WordPress sites utilizing the affected AMP for WP plugin versions are at risk. The CVSS v3.1 Base Score of 7.5 indicates a high severity vulnerability, reflecting the critical consequences of successful exploitation.

Recommendation

  • Patch CVE-2026-6101 immediately by updating the AMP for WP – Accelerated Mobile Pages plugin to version 1.1.13 or newer.
]]>highadvisorywordpresspluginarbitrary-file-writercewebserver