CVE-2026-10818

HighCVSS 8.1

Published: 25/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

35th percentile - higher than 35% of all known CVEs

Summary

The WPForms Pro plugin for WordPress up to version 1.10.1.1 is vulnerable to arbitrary file upload via the ajax_chunk_upload_finalize function. File type validation occurs after data is written to disk, and failed validation does not delete the assembled file. An unauthenticated attacker can upload executable files, leading to remote code execution.

Risk Assessment

Organizations using WPForms Pro are at risk of remote code execution by an unauthenticated attacker uploading a malicious file.

Recommendation

Update WPForms Pro to a version later than 1.10.1.1, which contains the fix.

Other vulnerabilities in WPForms Pro

CVE-2026-18409High
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute, which is not on WordPress's URI-attribute sanitization list, allowing a javascript: URI stored in data-src to survive kses processing and subsequently be promoted to a live src attribute by the bundled admin script view-entry.min.js.

Original NVD description (English source)

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.