CVE Intelligence
Analysis AI-assisted

CVE-2026-62024: WordPress CodeBard Help Desk Plugin - Arbitrary File Upload

CVE-2026-62024 is an arbitrary file upload vulnerability in the CodeBard Help Desk plugin for WordPress, affecting version 1.1.2 and earlier, as described by Patchstack. The record rates it critical with a CVSS base score of 9.9 and lists no fixed version. No confirmed exploitation appears in the sources consulted, and CISA KEV does not list it.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The Patchstack record describes an arbitrary file upload issue in the CodeBard Help Desk plugin for WordPress, affecting version 1.1.2 and earlier. The issue is reachable by a user with Subscriber-level access.

Impact

The record rates the issue critical, with a CVSS base score of 9.9 and high impact on confidentiality, integrity and availability. Unrestricted file upload (CWE-434) can allow unintended files to be stored on a server. Depending on server configuration, this could lead to code execution; this consequence is an inference, as the sources do not detail it.

Affected products and versions

  • CodeBard CodeBard Help Desk plugin, version 1.1.2 and earlier.
  • The record does not list any fixed version.

Exploitation status

CISA KEV does not list this CVE. The EPSS probability is 0.00447 and the SSVC exploitation value is none, with automatable set to no. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • The record does not identify a fixed version. Check the Patchstack entry and the plugin vendor for an update.
  • If no fix is available, consider deactivating the plugin until a corrected release is published.
  • Restrict who can obtain Subscriber accounts and review registration settings.
  • Limit permitted upload file types on the server and review how uploads are handled.

Detection guidance

  • Review the plugin's upload locations for unexpected or recently created files, especially script or executable types.
  • Review web server and application logs for upload activity from Subscriber accounts.
  • Monitor the web root for new files that were not deployed through normal processes.

Limitations of the available information

The record does not describe the vulnerable component, the exact conditions beyond the Subscriber role, or any fixed version. The source status is Deferred. Verify details against the Patchstack entry and the vendor before making decisions.

Frequently asked questions

What is CVE-2026-62024?

It is an arbitrary file upload vulnerability in the CodeBard Help Desk plugin for WordPress, affecting version 1.1.2 and earlier, as reported by Patchstack.

Is a fixed version available?

The record does not list a fixed version. Check the Patchstack entry and the plugin vendor for updates.

Is this vulnerability being actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

What can administrators do now?

Review the plugin, consider deactivating it if no fix exists, restrict Subscriber account creation, limit upload types, and monitor upload locations for unexpected files.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.