CVE-2026-81090

The Gpx2Graphics WordPress plugin through version 0.3 does not perform a CSRF check when handling file uploads and does not validate the type of the uploaded file. An attacker can craft a malicious page or link that, when opened by a logged-in administrator, silently uploads an arbitrary file such as a PHP webshell to the site. Because the uploaded PHP file can be executed on the server, this results in remote code execution and complete site takeover. Any WordPress site running Gpx2Graphics version 0.3 or earlier is affected. The flaw is rated high (CVSS 3.1: 7.2), is not on CISA's KEV list, and no public proof-of-concept or in-the-wild exploitation has been reported.

What to do: Deactivate and remove Gpx2Graphics if it is not needed, since the disclosure indicates every version through 0.3 is vulnerable and no patched version is specified. If it must remain, restrict who can reach the plugin's upload handling and audit the server (especially wp-content/uploads and any plugin upload directories) for unexpected PHP files or webshells, reviewing logs for suspicious upload activity. Rotate credentials if any sign of compromise is found.