{"id":"CVE-2026-104748","published":"2026-10-14T08:17:02.997","lastModified":"2026-10-15T17:17:11.513","description":"The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://plugins.svn.wordpress.org/simple-form/trunk/","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Assets.php#L265","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L184","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L291","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L32","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3726513/simple-form/trunk/app/Integrations/WordPressAuth.php","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The SimpleForm WordPress plugin has a privilege escalation vulnerability that allows unauthenticated attackers to create administrator accounts by manipulating form submission data. This occurs due to missing capability checks and improper user meta handling in the registration AJAX endpoint.","exploitability":"Very easy to exploit with no preconditions required, as the nonce is publicly exposed and attackers can directly submit malicious registration requests with administrator capabilities.","blast_radius":"High impact across all WordPress sites using the SimpleForm plugin version 3.10.0 or earlier, potentially leading to full site compromise and unauthorized administrative access.","remediation":"Upgrade to version 3.10.1 or later which contains the fix for this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","wordpress","plugin","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:53:38.698Z"}}