CVE-2026-84738 in AF Companion Plugin
Summary
by MITRE • 09/18/2026
The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in AF Companion versions prior to 2.2.0 represents a critical security flaw rooted in insufficient input validation during file upload operations. Specifically, the plugin fails to verify the MIME type or extension of files submitted through its import functionality. This oversight allows attackers who possess low-privileged credentials, such as those assigned to store-management roles, to bypass standard restrictions and upload arbitrary executable scripts, most notably PHP files, directly onto the web server hosting the WordPress instance. The absence of strict file type checking creates a direct pathway for malicious code injection, which is classified under CWE-434: Unrestricted Upload of File with Dangerous Type within common vulnerability enumeration standards.
From an operational perspective, this flaw enables Remote Code Execution (RCE), one of the most severe consequences in web application security. Once a PHP file containing malicious payloads is successfully uploaded to a writable directory accessible by the web server, an attacker can trigger its execution via HTTP requests. This effectively grants the attacker the same privileges as the web server process, typically allowing full control over the underlying operating system. The ability to execute arbitrary code means that attackers can exfiltrate sensitive data, install backdoors, pivot to other systems within the network, or deface the website. In the context of WordPress ecosystems, where plugins often have broad access to database and file system resources, this vulnerability significantly amplifies the blast radius of a compromised account.
The attack vector aligns with several techniques documented in the MITRE ATT&CK framework for enterprise environments. The initial step of uploading malicious files corresponds to T1505: Server Software Component, specifically under sub-techniques like T1505.003: Web Shell. Following successful upload and execution, the attacker may leverage T1059: Command and Scripting Interpreter to run system commands or interact with the database using SQL injection techniques if further exploitation is required. The use of low-privileged accounts for this attack highlights a common misconfiguration where user roles are granted more permissions than necessary, violating the principle of least privilege. This scenario underscores how even limited access can be escalated into full system compromise when input validation controls are weak or missing entirely.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary recommendation is to upgrade AF Companion to version 2.2.0 or later, where the developers have implemented proper file type validation mechanisms. For organizations unable to patch immediately due to compatibility concerns, temporary mitigations should include restricting upload directories via web server configuration files such as .htaccess for Apache or nginx configurations to deny execution of PHP scripts in user-uploaded folders. Additionally, implementing a Web Application Firewall (WAF) with rules designed to detect and block suspicious file uploads containing executable code can provide an additional layer of defense. Regular audits of plugin permissions are also essential to ensure that store-management roles do not possess unnecessary upload capabilities unless strictly required for business operations.