Privilege Escalation in SimpleForm Plugin for WordPress
CVE-2026-104748

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Simpleform – Form Maker To Chat Apps With Quiz, Poll And Multi Lead Notifications
Vendor
CVE Published:
14 October 2026

What is CVE-2026-104748?

The SimpleForm plugin for WordPress is vulnerable due to improper checks in the AJAX handler which allows unauthenticated attackers to create an Administrator-level account. This vulnerability arises from the absence of capability checks during role assignment and flaws in the handling of user metadata. Notably, the nonce required for this action is inadvertently exposed in the front-end JavaScript, making it easily accessible to potential attackers. Consequently, an attacker can exploit this flaw by sending specially crafted registration requests that include elevated privileges.

Affected Version(s)

SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications 0 <= 3.10.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/simple-form/ta...
https://plugins.trac.wordpress.org/browser/simple-form/ta...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sebastian Albrecht (mySebbe)
.