CVE-2026-118235
CriticalCVSS 9.8Summary
The SimpleForm plugin for WordPress (versions up to and including 3.10.2) is vulnerable to arbitrary file upload via the handle_upload function. Missing a server-side file key allowlist and pre-sanitization extension derivation allows a trailing-dot filename to bypass all extension and MIME validation, enabling unauthenticated attackers to upload executable files and achieve remote code execution. The only access control is a nonce printed into every public form's data-nonce attribute, trivially obtainable by any unauthenticated visitor.
Risk Assessment
An unauthenticated attacker can remotely execute code on the server, taking over the WordPress site. Exploitation only requires visiting a page embedding the form shortcode to obtain the nonce.
Recommendation
Update the SimpleForm plugin to a version later than 3.10.2 or disable it if no fix is available. Additionally, consider restricting file uploads and monitoring the uploads directory for unusual files.
Other vulnerabilities in SimpleForm WordPress plugin
Original NVD description (English source)
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS