Vulnerability · Published Jul 7, 2026 · Assigned by Wordfence

CVE-2026-6101AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload

High 7.5

In plain English

A high-severity security flaw in AMP for WP – Accelerated Mobile Pages from mohammed_kaludi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.0%top 36.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, and permissions granted by an Administrator, to write arbitrary files to the server in a web-accessible location, potentially leading to remote code execution on hosts that execute PHP files in the uploads directory.

Affected products (as reported)

Vendor	Product	Versions
mohammed_kaludi	AMP for WP – Accelerated Mobile Pages	0 – through 1.1.12

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References