CVE-2026-81402

The DS Ad Rotator WordPress plugin through version 0.8 exposes an image upload handler that performs no capability check, nonce verification, or file-type validation. Any unauthenticated attacker can send a crafted upload request directly to the vulnerable endpoint and write arbitrary files — including PHP scripts — into a web-accessible directory, where they can be executed to obtain remote code execution. Successful exploitation gives the attacker full control of the affected site and its underlying server, including data theft, defacement, and further pivoting. All sites running DS Ad Rotator 0.8 or earlier are affected, and no fixed version has been released. No public proof of concept is known and the flaw is not on CISA's KEV list, but exploitation is trivial for anyone who locates the endpoint, so exposure should be treated as immediately dangerous.

What to do: No patched release exists (every version through 0.8 is vulnerable), so deactivate and delete DS Ad Rotator and replace it with a maintained ad-rotation plugin. In the interim, block or restrict access to the plugin's upload endpoint via a WAF or web-server rule. Audit the plugin's upload directory and the site for unexpected .php files or recently modified files that could indicate a planted webshell; if any are found, assume full compromise and rotate all credentials, database keys, and salts.