Arbitrary File Upload Vulnerability in SimpleForm Plugin for WordPress
CVE-2026-118235

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Simpleform – Form Maker To Chat Apps With Quiz, Poll And Multi Lead Notifications
Vendor
CVE Published:
31 October 2026

What is CVE-2026-118235?

The SimpleForm plugin for WordPress is susceptible to an Arbitrary File Upload vulnerability due to its handle_upload function, which lacks proper server-side file key allowlisting and pre-sanitization for file extensions. This oversight allows attackers to exploit the system by uploading files with trailing dot filenames, circumventing all extension and MIME type validations, potentially leading to remote code execution. The access control mechanism is weak, relying solely on a nonce tied to public form data, making it easily retrievable by unauthorized users visiting the page with the form shortcode.

Affected Version(s)

SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications 0 <= 3.10.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/simple-form/ta...
https://plugins.trac.wordpress.org/browser/simple-form/ta...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

whysocscs
.