CVE-2026-6101: unsafe ZIP extraction enables file

CISO Take

This vulnerability sits in the AMP for WP WordPress plugin's font-upload feature: the ampforwp_save_local_font() function extracts attacker-supplied ZIP files without validating entry paths and fails to clean up nested directories afterward, letting a malicious archive plant files (including PHP) inside a web-accessible location. Despite the 7.5 CVSS score, the practical risk today is moderate rather than urgent — exploitation requires an authenticated account with Author-level privileges plus additional permissions granted by an Administrator, there is no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template available, and the internal package risk score is 0/100. Note for the record: despite being tagged "ml_library" in this feed, AMP for WP is a general-purpose WordPress mobile-page plugin with no AI/ML functionality — this CVE does not affect any AI pipeline, model, or agent architecture and appears mis-categorized upstream. Sites running affected versions (≤1.1.12) should update to the patched release immediately, audit which users hold Author-level access with extra Admin-granted permissions, and verify PHP execution is disabled in the uploads directory as defense in depth. Monitor `wp-content/uploads` for unexpected PHP files or nested directories as a detection signal for exploitation attempts.

Sources: NVD Wordfence wordpress.org

What is the risk?

CVSS 7.5 (high) reflects the worst-case outcome (full C/I/A compromise via RCE), but real-world exploitability is currently constrained: privileges required is low but non-trivial (Author-level plus Admin-granted permissions), attack complexity is rated high, there's no EPSS data, no KEV listing, no public PoC, and no scanner template — indicating this is not yet being actively targeted at scale. The primary risk driver is that any site allowing PHP execution in the uploads directory converts this arbitrary-file-write bug directly into remote code execution, which is a severe and hard-to-detect outcome once achieved.

How does the attack unfold?

Authenticated Access

Attacker uses an Author-level WordPress account (with extra permissions granted by an Administrator) to reach the AMP for WP font-upload feature.

Exploitation

A crafted ZIP file is submitted to ampforwp_save_local_font(), which extracts it without validating entry paths, writing files outside the intended directory (zip slip).

Persistence

Inadequate cleanup fails to remove nested directories and files, leaving a planted PHP file in a web-accessible location under wp-content/uploads.

Impact

Attacker requests the planted file's URL directly, achieving remote code execution on hosts that allow PHP execution in the uploads directory.

Authenticated Access

Attacker uses an Author-level WordPress account (with extra permissions granted by an Administrator) to reach the AMP for WP font-upload feature.

Exploitation

A crafted ZIP file is submitted to ampforwp_save_local_font(), which extracts it without validating entry paths, writing files outside the intended directory (zip slip).

Persistence

Inadequate cleanup fails to remove nested directories and files, leaving a planted PHP file in a web-accessible location under wp-content/uploads.

Impact

Attacker requests the planted file's URL directly, achieving remote code execution on hosts that allow PHP execution in the uploads directory.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

1.0%

chance of exploitation in 30 days

Higher than 62% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Update AMP for WP to the version that patches the changeset referenced at plugins.trac.wordpress.org/changeset/3512870/ (post-1.1.12). Until patched, restrict which users hold Author-level roles and audit any additional permissions Administrators have granted to Authors. Disable PHP execution inside wp-content/uploads (e.g., via web server config or a hardening plugin) as a blanket defense against arbitrary-file-write-to-RCE chains. Monitor the uploads directory for newly created PHP files or unexpected nested directory structures left behind by ZIP extraction, and review recent font-upload activity in AMP for WP for anomalies.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Plugin

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-6101?

This vulnerability sits in the AMP for WP WordPress plugin's font-upload feature: the ampforwp_save_local_font() function extracts attacker-supplied ZIP files without validating entry paths and fails to clean up nested directories afterward, letting a malicious archive plant files (including PHP) inside a web-accessible location. Despite the 7.5 CVSS score, the practical risk today is moderate rather than urgent — exploitation requires an authenticated account with Author-level privileges plus additional permissions granted by an Administrator, there is no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template available, and the internal package risk score is 0/100. Note for the record: despite being tagged "ml_library" in this feed, AMP for WP is a general-purpose WordPress mobile-page plugin with no AI/ML functionality — this CVE does not affect any AI pipeline, model, or agent architecture and appears mis-categorized upstream. Sites running affected versions (≤1.1.12) should update to the patched release immediately, audit which users hold Author-level access with extra Admin-granted permissions, and verify PHP execution is disabled in the uploads directory as defense in depth. Monitor `wp-content/uploads` for unexpected PHP files or nested directories as a detection signal for exploitation attempts.

Is CVE-2026-6101 actively exploited?

No confirmed active exploitation of CVE-2026-6101 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-6101?

Update AMP for WP to the version that patches the changeset referenced at plugins.trac.wordpress.org/changeset/3512870/ (post-1.1.12). Until patched, restrict which users hold Author-level roles and audit any additional permissions Administrators have granted to Authors. Disable PHP execution inside `wp-content/uploads` (e.g., via web server config or a hardening plugin) as a blanket defense against arbitrary-file-write-to-RCE chains. Monitor the uploads directory for newly created PHP files or unexpected nested directory structures left behind by ZIP extraction, and review recent font-upload activity in AMP for WP for anomalies.

What is the CVSS score for CVE-2026-6101?

CVE-2026-6101 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 1.02%.

What are the technical details?

Original Advisory

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, and permissions granted by an Administrator, to write arbitrary files to the server in a web-accessible location, potentially leading to remote code execution on hosts that execute PHP files in the uploads directory.

Exploitation Scenario

An attacker who has obtained or been granted an Author-level WordPress account (with the additional permissions an Administrator has assigned) uploads a crafted ZIP file through the AMP for WP "local font" upload feature. The ZIP contains path-traversal entries (zip slip) or a disguised PHP webshell; because ampforwp_save_local_font() extracts the archive without validating entry paths and doesn't clean up nested files afterward, the malicious file lands in a publicly accessible directory under wp-content/uploads. The attacker then requests the planted file's URL directly, and if the server executes PHP in that directory, achieves remote code execution on the host.

Weaknesses (CWE)

CWE-73 External Control of File Name or Path CWE-73 External Control of File Name or Path

CWE-73 — External Control of File Name or Path: The product allows user input to control or influence paths or file names that are used in filesystem operations.

[Architecture and Design] When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.
[Architecture and Design, Operation] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.