{"id":"CVE-2026-13158","title":"The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non…","summary":"The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non…","severity":"none","published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13158","references":[{"url":"https://wpscan.com/vulnerability/f101071f-402a-40a2-bbdb-666512cd4049/","label":"contact@wpscan.com"}],"tags":["nvd","exploit-available"],"epss":0.00347,"epssPercentile":0.28369,"ingestedAt":"2026-08-02T01:16:32.356Z","exploits":{"github":1,"githubRepos":["https://github.com/MinhHK68/CVE-2026-13158"],"checkedAt":"2026-09-23T07:13:47.654Z"},"exploitAvailable":true,"slug":"CVE-2026-13158","body":"## Overview\n\nThe Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":15,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4945,"id":"CVE-2026-13158","ts":1788887218337,"field":"exploit_available","old":"false","new":"true"},{"seq":3828,"id":"CVE-2026-13158","ts":1788886351204,"field":"exploit_available","old":"true","new":"false"},{"seq":2665,"id":"CVE-2026-13158","ts":1788883015896,"field":"exploit_available","old":"false","new":"true"},{"seq":1694,"id":"CVE-2026-13158","ts":1788882420233,"field":"exploit_available","old":"true","new":"false"},{"seq":802,"id":"CVE-2026-13158","ts":1788881853864,"field":"exploit_available","old":"false","new":"true"}]}