What is GHSA-r4mq-7p9v-x8fv?

GHSA-r4mq-7p9v-x8fv is a security advisory published by GitHub Security Advisories with Critical severity. The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be...

Which CVE IDs does GHSA-r4mq-7p9v-x8fv cover?

GHSA-r4mq-7p9v-x8fv covers the following CVE IDs: CVE-2026-16250. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r4mq-7p9v-x8fv?

GHSA-r4mq-7p9v-x8fv has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-r4mq-7p9v-x8fvCriticalCVSS 9.8

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be...

Vendor

GitHub Security Advisories

Published

August 3, 2026

Last Modified

August 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-16250 →

📋 Description

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16250
https://wpscan.com/vulnerability/05bd2683-ef3b-4816-a323-12d5e943612a
https://github.com/advisories/GHSA-r4mq-7p9v-x8fv