CVE-2026-14483

This vulnerability isn't a traditional authentication bypass — it's an architectural choice that fundamentally breaks the security model. The api_key and api_secret required to access the upload endpoint aren't secrets in any meaningful sense: they're hardcoded in SQL migration files distributed with the plugin itself. Every installation uses identical credentials that require no extraction because they're already public. The practical impact is worse than a typical file upload bug. Once someone knows these seeded credentials, they have a mass exploitation pathway against every site running this plugin — one toolkit works everywhere. This collapses the threat model from targeting individual sites to targeting the entire install base simultaneously. Three distinct failures compound here: static credential architecture, missing capability validation on the init hook, and absent file type checks. The CVSS 9.8 captures severity but obscures that patching file validation alone doesn't close the door — the static credentials remain valid and can be reused on any other code paths the vendor didn't harden. What you should check: First, locate and examine the plugin's SQL migration files for seeded api_key and api_secret values — these are the actual credentials regardless of what the admin interface shows. Second, verify whether the init hook registration includes any capability checks (currently it appears not to). Third, confirm whether the vendor has provided a credential rotation mechanism or whether any patch only addressed file validation while leaving credentials untouched. For abandoned plugins or sites no longer receiving updates: the seeded credentials persist in your database indefinitely. They don't expire when the plugin dies — they remain exploitable as long as the database table exists. Consider explicitly removing or rotating these credentials even on inactive deployments, as the credentials themselves are permanently disclosed in version control history.

Reviewed through automated stages and approved by a human before publication.