{
 "id": "WPSEC-2026-0981",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0981/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0981/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0981/index.md",
 "title": "Nexter Extension – Site Enhancements Toolkit <= 4.7.6 - Authenticated (Author+) Arbitrary File Upload via Custom Font Upload",
 "description": "The Nexter Extension plugin for WordPress is vulnerable to arbitrary file uploads via the Custom Upload Font feature in all versions up to, and including, 4.7.6. This is due to insufficient file type validation in the nxt_check_file_ext function, which used a substring match so that a filename such as 'x.ttf.php' was treated as a font. This makes it possible for authenticated attackers with Author-level access and above, who can upload media, to upload arbitrary files such as PHP scripts to the server, which may lead to remote code execution. The Custom Upload Font extension must be enabled.",
 "plugin": {
  "slug": "nexter-extension",
  "name": "Nexter Extension – Site Enhancements Toolkit",
  "full_name": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit",
  "wordpress_org": "https://wordpress.org/plugins/nexter-extension/",
  "advisories_url": "https://wpsec.com/vuln/plugin/nexter-extension/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/nexter-extension"
 },
 "type": "UPLOAD",
 "cwe": [
  "CWE-434"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.7.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.7.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.7.7",
 "remediation": "Update to 4.7.7 or later.",
 "fix_released": "2026-08-19T09:09:49+00:00",
 "published": "2026-10-15T08:49:41+00:00",
 "updated": "2026-10-15T08:15:57.467625+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0981/",
  "https://plugins.svn.wordpress.org/nexter-extension/tags/4.7.7/",
  "https://wordpress.org/plugins/nexter-extension/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/nexter-extension",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-15"
 }
}