CVE-2026-14560
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.
- Published Sep 11, 2026
- CVSS 10.0 critical
- 0.4% chance of exploitation in the next 30 days (EPSS)