This specific vulnerability is identified as CVE-2026-81648 and possesses a CVSS score of 10.0. Should this defect be successfully exploited, it grants unauthenticated users the capability to remove any files residing on the server and to pull data from it.
This situation highlights the critical operational risk posed by unaddressed vulnerabilities in third-party platform components, directly affecting infrastructure integrity.
The ongoing attempts by threat actors to exploit this flaw underscore the necessity for timely patching across deployed systems.
Why it matters
This critical vulnerability poses a severe risk to any platform using this plugin, threatening data integrity and operational security. Operators must immediately verify if they are running this software and apply necessary patches to mitigate the threat.
