CVE-2026-13158 in Everest Toolkit Plugin
Summary
by MITRE • 08/01/2026
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The Everest Toolkit WordPress plugin vulnerability represents a critical security flaw that enables unauthorized code execution through improper file validation during demo content import operations. This issue affects versions 1.2.3 and earlier, creating a pathway for attackers with administrative privileges to compromise WordPress installations. The vulnerability stems from the plugin's failure to properly validate file types when processing uploaded content, effectively disabling WordPress's built-in file-type verification mechanisms that are designed to prevent malicious file uploads.
The technical implementation of this flaw allows high-privilege users to bypass standard security controls by uploading PHP files directly to the WordPress uploads directory. This directory is typically accessible via web requests, meaning that once a malicious PHP file is uploaded, it can be executed by the web server and potentially provide attackers with remote code execution capabilities. The vulnerability specifically targets administrators and site administrators on multisite installations, expanding the potential attack surface significantly since these roles often possess elevated privileges and access to critical system functions. Security researchers have identified this issue as a direct violation of secure coding practices that should prevent unvalidated file uploads from being processed within web-accessible directories.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables attackers to establish persistent backdoors, exfiltrate data, or deploy additional malware within the compromised WordPress environment. The affected plugin's demo content import feature is designed for legitimate use cases but becomes a security vector when file type validation is disabled. This weakness can be exploited by both external attackers who gain administrative credentials through other means and internal threat actors with existing administrative access. The vulnerability creates a persistent threat model where attackers can maintain access even after initial compromise, as the uploaded PHP files remain in the uploads directory and can be executed repeatedly.
Organizations should implement immediate mitigations including disabling the demo content import functionality when not actively needed, implementing additional file validation layers beyond WordPress defaults, and monitoring upload directories for suspicious activity. The vulnerability aligns with common weakness enumerations such as CWE-434, which addresses "Unrestricted Upload of File with Dangerous Type," and maps to ATT&CK techniques including T1190 for Exploit Public-Facing Application and T1059 for Command and Scripting Interpreter. Regular security audits should verify that all WordPress plugins maintain proper file validation mechanisms, particularly during content import operations. System administrators must also ensure that the uploads directory has appropriate access controls and that file permissions are properly configured to prevent unauthorized execution of uploaded files. The incident underscores the importance of maintaining secure coding practices throughout plugin development cycles and demonstrates how seemingly benign features can become security risks when proper validation controls are omitted.