Summary
CVE-2026-75799 is a critical remote code execution vulnerability in the YAHMAN Add-ons WordPress plugin, caused by insufficient validation of remote files cached by the plugin in a publicly accessible directory. The flaw allows unauthenticated attackers to write arbitrary PHP files to the server and achieve code execution when the affected caching feature is enabled. The vulnerability carries a CVSS v3.1 base score of 9.0 (Critical).
Technical details
- Root cause: The plugin caches remote files in a publicly accessible directory without validating the file type of the cached content.
- Trigger conditions: Exploitation requires that the plugin’s relevant remote-caching feature be enabled on the target site.
- Attack vector: Network — no authentication and no user interaction are required (CWE-94, Improper Control of Generation of Code / Code Injection).
- Impact: An unauthenticated attacker can cause the plugin to cache a malicious file as a PHP script in a web-accessible location, then execute it directly, resulting in full remote code execution on the underlying server.
Affected software
- YAHMAN Add-ons WordPress plugin — all versions prior to 0.9.31
Severity
- CVSS v3.1 Base Score: 9.0 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Update the YAHMAN Add-ons plugin to version 0.9.31 or later, which validates cached remote file types and remediates the arbitrary PHP file write.
- If patching is not immediately possible: Disable the plugin’s remote file caching feature until the update can be applied, and audit the plugin’s cache directory for unexpected PHP files. Restrict public web access to plugin cache/upload directories and consider blocking execution of PHP files in those directories via server configuration as a temporary compensating control.