The teddy-bear-customize-addon WordPress plugin

Published September 11, 2026 CVE-2026-14560

A WordPress plugin called Teddy Bear Customize Addon lets anyone on the internet upload a malicious PHP file to a website and take it over completely, no login required.

Severity
CriticalCVSS 3.1 · 10.0 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Fix
Fix not establishedNo fixed release identified in this report
Affected versions
through 1.0.5
Weakness
CWE-94Code Injection
Exploit likelihood
0.23% in 30 daysEPSS, higher than 13% of known flaws
Affects
teddy-bear-customize-addon
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: yes · Technical impact: total
EU ID
EUVD-2026-75959ENISA vulnerability database

How it works

  • The plugin's file upload feature trusts the file type label the visitor's browser sends instead of checking the file itself.
  • It also keeps the uploaded file's original name and extension.
  • An attacker can name a file something.php, tell the upload form it is an image, and the plugin saves it as-is on the server.
  • Visiting that uploaded PHP file in a browser then runs the attacker's code directly on the site.
  • No account or login is needed to do any of this.

What to do

Check your WordPress admin dashboard under Plugins for "Teddy Bear Customize Addon" and note its version number. If it is version 1.0.5 or any earlier version, your site is exposed to this flaw. Compare the installed version against the WPScan advisory for the latest status.

Deactivate and remove the Teddy Bear Customize Addon plugin now, since the WPScan advisory lists no known fixed version. Check the WPScan advisory page periodically for an updated version that patches this issue. Watch your site's uploads folder and file listings for unfamiliar.php files, which would indicate the flaw was already used against you, and contact your host or a security professional if you find any.

Technical details

CVE-2026-14560 affects the teddy-bear-customize-addon WordPress plugin through version 1.0.5. The upload handler validates file type using the client-supplied Content-Type header rather than inspecting file contents, and preserves the original filename and extension. This lets an unauthenticated attacker upload a.php file that WordPress's file system will later execute if requested directly, giving full code execution in the web server's context.

CVSSv3 is 10.0 (critical), CWE-94 (Improper Control of Generation of Code). No fixed version is currently published.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source