CVE-2026-16985
Squeeze < 1.7.12 - Author+ Arbitrary File Upload
CVSS Score
8.8
EPSS Score
0.2%
EPSS Percentile
9th
The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.
| Vendor | unknown |
| Product | squeeze |
| Published | Aug 10, 2026 |
| Last Updated | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown squeeze
Be the first to know when new high vulnerabilities affecting unknown squeeze are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Squeeze
0 < 1.7.12
References
Credits
Ezekiel Victor WPScan