CVE-2026-42748: WPify Woo Czech WordPress Plugin - Arbitrary File Upload
CVE-2026-42748 is an unrestricted file upload vulnerability (CWE-434) in the WPify Woo Czech plugin for WordPress, affecting versions up to and including 5.4.1. The record states that it allows an attacker to upload a web shell to the web server, and the Patchstack CNA rates it 9.9 (Critical) under CVSS 3.1. No fixed version and no confirmed exploitation were found in the sources consulted.
Overview
CVE-2026-42748 is classified as CWE-434, Unrestricted Upload of File with Dangerous Type, in the WPify Woo Czech plugin (wpify-woo) for WordPress. The record was published on 2026-05-27 by the Patchstack CNA and is listed with a source status of Deferred.
Impact
The record states that the flaw allows an attacker to upload a web shell to a web server. The Patchstack CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, with a base score of 9.9. Under this vector, the impact on confidentiality, integrity and availability is rated high and the scope is changed.
Affected products and versions
- Product: WPify WPify Woo Czech (wpify-woo)
- Affected versions: up to and including 5.4.1 (the record gives "n/a" as the starting version)
No fixed version is listed in the available record.
Exploitation status
CISA KEV does not list this CVE. The SSVC fields in the record indicate exploitation "none" and automatable "no". No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00479 (percentile 0.39633), which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Identify all sites running the WPify Woo Czech plugin and check the installed version against the affected range.
- Check the vendor or Patchstack entry for an updated release, since the record does not list a fixed version.
- Until a fixed release is confirmed, consider disabling the plugin on sites where it is not essential, and restrict upload capabilities to trusted roles.
- Restrict write permissions on web directories so that uploaded files cannot be executed where they are stored.
Detection guidance
- Review web server and application logs for unexpected file uploads, especially new script-type files in upload or plugin directories.
- Audit WordPress installations for unfamiliar files or recently modified PHP files.
- Monitor for unexpected outbound or inbound requests to newly created files.
Limitations of the available information
The record does not include a vendor advisory, a fixed version, exploit details, or the specific vulnerable endpoint or parameter. The affected-version start is listed as n/a. The CVSS data comes from Patchstack and is consistent across two entries. Information on authentication requirements beyond the vector's PR:L component is not provided in more detail.
Frequently asked questions
What is CVE-2026-42748?
It is an unrestricted file upload vulnerability (CWE-434) in the WPify Woo Czech WordPress plugin, affecting versions up to and including 5.4.1, according to the record.
Is this vulnerability actively exploited?
The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Is there a fixed version?
The available record does not list a fixed version. Check the vendor or Patchstack entry for updates.
What should administrators do now?
Identify affected installations, consider disabling the plugin where it is not essential, restrict upload permissions, and monitor for unexpected uploaded script files.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.