CVE-2026-115212
mView <= 1.0.3 - Subscriber+ Arbitrary File Upload
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution.
| Vendor | unknown |
| Product | mview 豆瓣电影 |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown mview 豆瓣电影
Be the first to know when new high vulnerabilities affecting unknown mview 豆瓣电影 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / mView 豆瓣电影
0 ≤ 1.0.3
References
Credits
Muni Nitish Kumar Yaddala WPScan