CVE-2026-81402 – The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonc

The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.