{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/yaycommerce/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yaycommerce:yaysmtp:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-92553"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["YaySMTP (\u003c= 2.7.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["YayCommerce"],"content_html":"\u003cp\u003eThe YaySMTP - WP Mail SMTP with Email Logs, Tracking \u0026amp; Reports plugin for WordPress (versions up to and including 2.7.7) contains a critical arbitrary file upload vulnerability within its putFile function. The flaw stems from improper file type validation, as the plugin fails to utilize an allow-list, perform MIME-type checking, or sanitize executable file extensions via the existing sanitize_file_name() function. While the developer attempted to implement a security guard via a .htaccess file generated by writeGuards(), this mechanism is ineffective on nginx servers and Apache configurations where AllowOverride is set to None. Consequently, an authenticated attacker with subscriber-level access or higher can upload arbitrary files, including web shells, to the WordPress environment, resulting in full remote code execution (RCE). The vulnerability is tracked as CVE-2026-92553.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated users with minimal privileges to gain complete control over the affected WordPress installation. This impact is significant for environments running on nginx or restricted Apache configurations, as the intended security measures are bypassed. Unauthorized code execution can lead to data exfiltration, defacement, or persistent access to the underlying web server infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the YaySMTP plugin to the latest version that patches CVE-2026-92553.\u003c/li\u003e\n\u003cli\u003eAudit web server configurations to ensure that file upload directories are prevented from executing scripts by default.\u003c/li\u003e\n\u003cli\u003eMonitor WordPress authentication logs for suspicious subscriber-level activity or unusual file creation patterns within the plugin's upload directories.\u003c/li\u003e\n\u003cli\u003eConfigure security policies to disallow direct execution of uploaded content in directories managed by plugins.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T08:25:47Z","date_published":"2026-10-16T08:25:47Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-92553/","summary":"The YaySMTP WordPress plugin (\u003c= 2.7.7) is vulnerable to arbitrary file upload due to insufficient validation in the putFile function, allowing authenticated users to achieve remote code execution.","title":"Arbitrary File Upload Vulnerability in YaySMTP WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-92553/"}],"language":"en","title":"CraftedSignal Threat Feed - YayCommerce","version":"https://jsonfeed.org/version/1.1"}