Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files() (CVE-2026-2354) | HOL Guard CVE