CVE Intelligence
Analysis AI-assisted

CVE-2026-57700: Daan.Dev OMGF Pro - Unrestricted File Upload of Dangerous Type (CWE-434)

CVE-2026-57700 describes an unrestricted file upload of dangerous type (CWE-434) in Daan.Dev OMGF Pro, which the record says allows the use of malicious files in versions from n/a through 5.2.6. The CNA Patchstack scored it 10.0 (critical) under CVSS 3.1 with network attack vector and no privileges or user interaction required. No fixed version and no confirmed exploitation appear in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-57700 is recorded as an unrestricted upload of file with dangerous type (CWE-434) in Daan.Dev OMGF Pro. The reference cited in the record is a Patchstack database entry for a WordPress plugin, which places the product in the WordPress ecosystem.

Impact

  • The record assigns a CVSS 3.1 base score of 10.0 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, provided by audit@patchstack.com.
  • Read from the vector, the flaw is reachable over the network, needs no privileges, needs no user interaction, and has high confidentiality, integrity and availability impact with scope changed.
  • The record itself only states that the issue allows the use of malicious files.

Affected products and versions

  • Product: Daan.Dev OMGF Pro.
  • Range stated in the record: from n/a through 5.2.6.
  • The record lists no structured affected or fixed entries. The lower bound n/a means the record does not state where the range starts.

Exploitation status

  • The CISA KEV catalog entry is marked as not listed in the record.
  • No confirmed exploitation in the wild appears in the sources consulted for this analysis.
  • The EPSS score and SSVC data are absent from the record.

Remediation and mitigation

  • The record does not identify a fixed version. The absence of a fix in the record does not mean none exists; check the vendor and the Patchstack entry for patch status.
  • Until a vendor fix is confirmed, consider disabling or removing the plugin on sites where it is installed and not essential.
  • Restrict who can upload files to the site, and review upload handling for file type validation performed on the server side.
  • Keep backups and a documented rollback plan before any plugin change.

Detection guidance

  • Review media and plugin upload directories for files with unexpected extensions or types, especially executable or script files created recently.
  • Review web server and application logs for unusual upload requests to plugin endpoints.
  • Compare installed plugin files against a known clean copy from the vendor after the fix is confirmed.

Limitations of the available information

  • The record has no title, no structured affected or fixed versions, and no vendor advisory text beyond the description.
  • The Patchstack reference slug refers to host-google-fonts-pro while the description names OMGF Pro; the product identity should be confirmed with the vendor.
  • The record's source status is Deferred, so details may change.
  • The version lower bound is n/a, so the affected range start is unknown.

Frequently asked questions

Is CVE-2026-57700 being actively exploited?

The record marks it as not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. Monitor the vendor and CISA for changes.

Which versions are affected?

The record states the range from n/a through 5.2.6 for OMGF Pro. The lower bound is not specified, and no structured affected or fixed version list is provided.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.