CVE-2026-32559 describes an Arbitrary File Upload vulnerability affecting the UltimateAI WordPress plugin in versions 3.1.0 and below. The flaw allows subscriber-level authenticated users to upload arbitrary files to the server, which could lead to remote code execution or site compromise. This type of vulnerability is particularly dangerous in WordPress environments as it can allow low-privileged users to gain elevated access. The vulnerability has been documented by both the NVD and Patchstack security database. Users of the UltimateAI plugin are advised to update to a patched version immediately. The issue is rated as high severity given the potential for significant impact on affected WordPress installations.