CVE-2026-104748
CriticalCVSS 9.8Summary
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0. The `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacks any capability check for role assignment and the `save_custom_fields_to_user_meta()` function uses an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning hard-coded defaults that unconditionally enable meta writing. This allows unauthenticated attackers to create an Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1`; the required nonce is publicly emitted into the `front_end_data` JavaScript object on every front-end page.
Risk Assessment
An unauthenticated attacker can create an Administrator-level WordPress account, taking full control of the site. This leads to complete site takeover, malicious code installation and data theft.
Recommendation
Immediately update the SimpleForm plugin to a version later than 3.10.0 or disable it if no fix is available. Also check whether unauthorised administrator accounts have been created.
Related vulnerabilities
- CVE-2026-103904Critical
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend, allowing script code injection that executes in an administrator's browser session.
- CVE-2026-14851Critical
A vulnerability in the customer invoicing web application exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint serving PDF invoice files. Furthermore, some invoicing document URLs appear to be publicly accessible via search engines, exposing paths to confidential files.
- CVE-2026-89310Critical
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.
- CVE-2026-87855Critical
The JTL-Connector plugin for WooCommerce up to version 2.4.3 is vulnerable to arbitrary file upload via the saveImage() function. This is due to accepting an empty jtlauth parameter as valid credentials and insufficient file type validation in handleImagePush(). This allows unauthenticated attackers to upload executable files, leading to remote code execution.
- CVE-2026-104800Critical
The AGE-GATE plugin for WordPress up to version 1.0 is vulnerable to remote code execution via the 'width' and 'height' parameters. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters into generated PHP source. This allows unauthenticated attackers to execute code on the server.
- CVE-2026-97668Critical
The Abandoned Cart Pro plugin for WooCommerce up to version 10.8.0 is vulnerable to SQL injection via the guest cart persistent meta_value. This is due to insufficient escaping and lack of prepared statements in the update_guest_persistent_cart() function. The abandoned_cart_info value is concatenated directly into an UPDATE statement, allowing unauthenticated attackers to append additional SQL, potentially leading to data extraction and privilege escalation.
- CVE-2026-97657Critical
The Abandoned Cart Pro plugin for WooCommerce up to version 10.8.0 is vulnerable to authentication bypass via malleable encryption and bypassable HMAC. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens and a conditional HMAC check that can be bypassed by omitting the wcap_nonce parameter. This allows unauthenticated attackers with a single legitimate link to forge ciphertext and take over any user's account, including administrators.
- CVE-2026-110447Critical
Collabora Online Built-in CODE Server before version 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, exploited in the wild in September and October 2026. This is an OS command injection in proxy.php when the CODE server isn't running. The vulnerability is not present in standalone Collabora Online servers.
- CVE-2026-110002Critical
The Snazzy Social Media Feed plugin for WordPress up to version 2.5 is vulnerable to arbitrary file upload via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter. This allows authenticated attackers with subscriber-level access and above to upload executable files, leading to remote code execution.
- CVE-2026-93388Critical
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce up to version 2.9.1 is vulnerable to unauthenticated arbitrary file upload leading to remote code execution. The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers, and its Google Drive branch rebuilds the destination filename from the raw gapi[name] parameter, bypassing the allow-list, and writes the fetched bytes to a web-accessible directory. This allows unauthenticated attackers to write a .php file to an executable location and execute arbitrary code on the server.
Original NVD description (English source)
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS