{"id":"CVE-2026-118235","published":"2026-10-31T09:16:33.620","lastModified":"2026-10-31T09:16:33.620","description":"The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://plugins.svn.wordpress.org/simple-form/trunk/","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L67","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L973","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L988","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L118","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L137","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L142","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3770697/simple-form/trunk/app/FileUpload.php","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aac2178-f6ce-4444-9afc-7e014547cd48?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The plugin's file upload function lacks proper server-side validation and allows unauthenticated users to upload executable files by exploiting a trailing-dot filename bypass, leading to potential remote code execution.","exploitability":"Exploitation is trivial for unauthenticated attackers because the required nonce is exposed in public HTML and no meaningful access controls or file validation exist.","blast_radius":"Successful exploitation could allow full system compromise including data theft, server takeover, and lateral movement within the hosting environment.","remediation":"Upgrade to version 3.10.3 or later, which reportedly patches the vulnerable handle_upload function by enforcing strict file extension allowlists and pre-sanitization.","detection":"Look for unexpected executable files (e.g., .php, .phtml, .js) uploaded to publicly accessible directories via form submissions; monitor web server access logs for POST requests to upload endpoints with suspicious filenames ending in a dot (e.g., 'malware.php.') and non-standard Content-Type headers.","tags":["rce","file-upload","auth-bypass","web","wordpress"],"model":"garnet-coder","analyzedAt":"2026-11-01T09:47:01.253Z"}}