CVE-2026-84171

The piclect WordPress plugin through version 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory. An unauthenticated attacker can simply send a crafted file (for example, a PHP webshell) to the plugin's upload endpoint and then reach it via its public URL, achieving arbitrary code execution and full server compromise. Any site running piclect through 1.0 with the plugin active is affected, and the flaw requires no authentication, user interaction, or privileges (CVSS 9.8). There is no known public PoC and the issue is not in the CISA KEV catalog, so exploitation status is currently none known, though the attack itself is trivial to reproduce. Defenders should treat any site running this plugin as potentially compromised.

What to do: There is no indicated patched version, so remove or disable the piclect plugin entirely until a fixed release is available. Immediately inspect the plugin's public upload directory and the webserver for unexpected files (especially .php or .phtml shells) and rotate credentials/keys if any are found. As an interim control, block unauthenticated POST requests to the plugin's upload endpoint at the WAF or reverse proxy.