CVE-2026-6101 mohammed_kaludi CVE debrief

Who should care

WordPress site administrators and users of the AMP for WP – Accelerated Mobile Pages plugin should be aware of this vulnerability, especially if they have not updated to a patched version. The vulnerability allows for arbitrary file writes, which can lead to remote code execution under certain conditions.

Technical summary

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. The vulnerability arises from unsafe ZIP file extraction in the ampforwp_save_local_font() function and inadequate cleanup that fails to remove nested directories and files. Authenticated attackers with Author-level access and above, and permissions granted by an Administrator, can write arbitrary files to the server in a web-accessible location. This could potentially lead to remote code execution on hosts that execute PHP files in the uploads directory.

Defensive priority

High

Recommended defensive actions

• Update the AMP for WP – Accelerated Mobile Pages plugin to a version beyond 1.1.12.
• Restrict file write permissions in web-accessible directories.
• Monitor server logs for suspicious file write activities.
• Implement additional security measures such as web application firewalls (WAFs) to detect and prevent exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-07T14:16:34.543Z and was last modified on 2026-07-07T15:16:49.807Z. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. The NVD entry is currently Deferred.

Official resources