Arbitrary File Upload Vulnerability in IvyForms Plugin for WordPress

CVE-2026-109384

What is CVE-2026-109384?

The IvyForms plugin for WordPress has a vulnerability that allows authenticated attackers with custom-level access to upload potentially malicious files. This issue stems from insufficient validation of file types in the filterFiletypeAndExt function, leading to the risk of executing arbitrary code remotely. Attackers can exploit this by configuring upload fields to accept dangerous file extensions (like .php) in the allowed list, consequently enabling unauthenticated users to upload harmful files via a publicly exposed REST route. Website administrators should ensure that they address this security flaw by restricting allowed file types and monitoring uploads closely.

References