CVE-2026-16292

The CVSS 5.4 rating for this CVE fundamentally misrepresents the actual risk. Treat it as a high-severity issue regardless of the official score. This is a CSRF vulnerability in a WordPress plugin's file metadata update endpoint—but the vulnerability becomes dramatically worse depending on your configuration. When 'guest uploads' or 'anonymous uploads' are enabled, the same action becomes reachable without any authentication at all. An unauthenticated attacker can manipulate file metadata to force the server to serve any file belonging to any user on the site. The most critical question to answer for your environment: what does the metadata actually control? If the plugin uses metadata fields—URL paths, MIME types, visibility flags—as part of its file retrieval or access logic, then you're looking at a design-level flaw, not just a missing nonce. Metadata being used as authorization logic means client-supplied data is making access decisions, which is fundamentally broken and would require more than a token fix to address. The blast radius is severe. WordPress sites accumulate sensitive files over time: password-reset documents, profile images with embedded EXIF data, WooCommerce order exports, Gravity Forms submissions containing PII, user-uploaded database backups. A successful exploit gives the attacker horizontal access to every file every user has ever uploaded—not just a single asset, but a complete pivot across the user base's file storage. Check your plugin configurations immediately. If guest uploads are enabled, treat this as an unauthenticated arbitrary file read vulnerability until proven otherwise. The vulnerability exists in the gap between what the code was originally designed for (authenticated users) and what the configuration toggle now permits (anyone). Even if you have no evidence of exploitation, the exposure window since the feature was enabled likely contains years of accumulated sensitive uploads.

Reviewed through automated stages and approved by a human before publication.