AskAny: unauthenticated PHP file upload (CVE-2026-121497)
A vulnerability, CVE-2026-121497 (CVSS 9.8), was published for the AskAny WordPress plugin. It does not validate the extension or content of files attached to chat messages and trusts the file type supplied by the browser.
Checked in Shield: no
Who is affected
Sites running AskAny before version 2.2.0 with visitor attachments enabled. No login is required: any visitor can upload a PHP file and execute arbitrary code.
How to check
In the WordPress admin, open Plugins and check the AskAny version. Then check the plugin settings to see whether visitor attachments are enabled. It is also worth looking for unexpected PHP files in the uploads directory.
How to fix
A fix is available: update AskAny to version 2.2.0 or later. If you cannot update right away, disable visitor attachments in the plugin settings.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
It is not disclosed yet whether the issue is exploited in the wild. Source: NVD entry for CVE-2026-121497.
