CVE-2026-32523: WPJAM Basic WordPress plugin unrestricted file upload

Overview

CVE-2026-32523 is a file upload weakness classified as CWE-434, Unrestricted Upload of File with Dangerous Type, in the WPJAM Basic plugin (wpjam-basic) for WordPress from denishua. The CNA, Patchstack, describes it as allowing the use of malicious files. Details are available in the Patchstack database entry.

Impact

• The CVSS 3.1 vector recorded is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, with a base score of 9.9 (critical) from the CNA.
• Under that vector, the attack is network-reachable with low complexity, requires low privileges and no user interaction, changes scope, and has high impact on confidentiality, integrity and availability.
• Because the weakness concerns unrestricted uploads, successful exploitation could allow dangerous file types to be stored on the server. The record does not detail the specific resulting effects.

Affected products and versions

• Product: WPJAM Basic (wpjam-basic), a WordPress plugin from denishua.
• Range according to the record: from n/a through 6.9.2 (less than or equal to 6.9.2).
• The record contains no structured affected or fixed version list, so the exact boundary should be verified against the Patchstack entry and the vendor.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The recorded EPSS probability is 0.00479, with a percentile of 0.39634.

Remediation and mitigation

• Identify whether WPJAM Basic is installed on your WordPress sites and which version is running.
• Because no fixed version is listed in the record, check the Patchstack entry and official plugin channels for an update, and apply it as soon as it is confirmed.
• Until a fix is confirmed, review which user roles can reach upload features, restrict them where possible, and keep WordPress core and other plugins current.
• Test temporary compensating controls, such as upload restrictions at the web server or a web application firewall, in a staging environment before production use.

Detection guidance

• Review web server and application logs for unexpected file creation in upload or plugin directories, particularly files with executable or script extensions.
• Monitor the WordPress installation for new files that do not match normal update activity, and compare file integrity against a known-good baseline.
• Audit recently created or modified administrative accounts and plugin settings.

Limitations of the available information

• The record has no title, no structured affected or fixed version list, and no description of the vulnerable function or preconditions.
• The record shows two CVSS 3.1 score entries with the same value; it does not explain the assessment method beyond the vector shown.
• The source status is listed as Deferred, so enrichment may change these details.
• The record's publication date is 2026-03-25.

Frequently asked questions

What is CVE-2026-32523?

It is an unrestricted file upload weakness (CWE-434) in the WPJAM Basic WordPress plugin by denishua, reported for versions through 6.9.2.

How severe is it?

The CNA Patchstack scored it 9.9 (critical) under CVSS 3.1 with a network attack vector and high impact on confidentiality, integrity and availability.

Is it being actively exploited?

The CVE is not listed in CISA KEV in the record, and no confirmed active exploitation appears in the sources consulted.

Is there a fixed version?

The record does not list a fixed version. Check the Patchstack entry and the plugin vendor for an update.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.