CVE-2026-6101

The AMP for WP plugin contains a security flaw that allows malicious users with administrator-level privileges or higher to create arbitrary files on the server. This is due to an issue with how the plugin handles ZIP file extraction and subsequent cleanup, resulting in vulnerable directories being left intact. As a consequence, attackers can potentially write executable code to the uploads directory, giving them unauthorized access to the server.

Based on public CVE data (MITRE/NVD).