CVE-2026-115212— mView <= 1.0.3 - Subscriber+ Arbitrary File Upload

Quick assessment

Affected

Unknown mView 豆瓣电影

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

mView 豆瓣电影 WordPress 插件（1.0.3 及更早版本）在将远程获取的文件保存到可被 Web 访问的目录之前，未验证文件的类型、名称或来源，也未执行任何权限或授权检查。这使得任何已认证用户（包括订阅者）能够上传任意 PHP 文件，进而实现远程代码执行。

AI Predicted 8.8 Difficulty: Easy Updated Nov 09, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Updated Nov 09, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

mView <= 1.0.3 - Subscriber+ Arbitrary File Upload

Source: CVE Program / CVE List V5

Vulnerability Description

The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	mView 豆瓣电影	0 ~ 1.0.3	-

II. Public POCs for CVE-2026-115212

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115212

请登录查看更多情报信息。

Other References for CVE-2026-115212 (1)

https://wpscan.com/vulnerability/c1fd09cb-0df7-4643-a888-1873c90e7b64/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-115212

Same Patch Batch · Unknown · 2026-11-09 · 23 CVEs total

CVE-2026-115252	10.0 CRITICAL	Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option
CVE-2026-106466	7.5 HIGH	JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh To
CVE-2026-106008	5.3 MEDIUM	FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass v
CVE-2026-115204		AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import
CVE-2026-115237		Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code
CVE-2026-115213		EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authenticatio
CVE-2026-115256		Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Acc
CVE-2026-120409		All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via
CVE-2026-118201		Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC
CVE-2026-118202		Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-F
CVE-2026-121759		Fusion Page Builder < 1.7.1 - Contributor+ Arbitrary Post Trashing via IDOR
CVE-2026-121874		Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name
CVE-2026-123091		Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms
CVE-2026-123064		WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalat
CVE-2026-123088		UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII
CVE-2026-123128		GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Cond
CVE-2026-121875		Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignme
CVE-2026-81422		Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registrat
CVE-2026-123129		Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Tick
CVE-2026-123131		GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Cont

Showing top 20 of 23 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Unknown