CVE-2026-14560

CVE-2026-14560 is an unauthenticated arbitrary file upload flaw in the teddy-bear-customize-addon WordPress plugin (all versions through 1.0.5) that leads to remote code execution, classified as CWE-94 code injection. The plugin fails to validate uploads server-side, trusting the client-supplied content type and preserving the attacker's original filename, so an unauthenticated attacker can upload a file such as a PHP web shell directly to the server. When the uploaded PHP file is requested over the web, the attacker executes arbitrary code with the privileges of the web server, enabling full site compromise and potential lateral movement on shared hosting. Any WordPress installation running the plugin through 1.0.5 is affected; exposure is limited to sites using this niche customization addon. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time, but the trivially exploitable network vector (CVSS 10.0) makes opportunistic scanning likely.

What to do: Update the teddy-bear-customize-addon plugin to the latest available version as soon as a patched release is published (all versions through 1.0.5 are vulnerable); if no fix is available yet, deactivate or remove the plugin. Audit the uploads directory for unexpected .php files and review access logs for unauthenticated POST requests to the upload endpoint to detect any compromise. As a stopgap, block direct execution of PHP files in the uploads directory or apply WAF rules requiring server-side validation of upload types.