CVE-2026-66627

Full vulnerability record from the local CVENow database.

Description

Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5.

Severity

CRITICAL

CVSS score

9.9 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-08-18 15:16:57.563000

Last modified

2026-10-22 22:10:00.250000

View original CVE JSON

{
  "id": "CVE-2026-66627",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T15:16:57.563",
  "lastModified": "2026-10-22T22:10:00.250",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion.\n\nThis issue affects GP Premium: from n/a through 2.5.5."
    },
    {
      "lang": "es",
      "value": "Carga de Archivos Arbitrarios por Contribuidor en versiones de GP Premium menor o igual que 2.5.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "EDGE22 Studios Ltd.",
          "product": "GP Premium",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "n/a",
              "lessThanOrEqual": "2.5.5",
              "versionType": "custom",
              "status": "affected",
              "changes": [
                {
                  "at": "2.5.6",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-18T15:09:14.545771Z",
          "id": "CVE-2026-66627",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://patchstack.com/database/wordpress/plugin/gp-premium/vulnerability/wordpress-gp-premium-plugin-2-5-5-arbitrary-file-upload-vulnerability?_s_id=cve",
      "source": "[email protected]"
    }
  ]
}