{"id":"CVE-2026-118423","published":"2026-11-06T08:17:18.550","lastModified":"2026-11-06T08:17:18.550","description":"The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/35149a79-aee1-4f13-ba29-583c2224c5da/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WP Libre Form plugin version 1.5.0.1 lacks file type validation during uploads, permitting unauthenticated users to upload and execute arbitrary PHP files, resulting in remote code execution (RCE).","exploitability":"Exploitation is trivial for unauthenticated attackers due to the absence of authentication, authorization, or input validation on file uploads.","blast_radius":"Successful exploitation grants full remote code execution with web server privileges, enabling complete compromise of confidentiality, integrity, and availability of the affected system and potentially downstream infrastructure.","remediation":"Upgrade to WP Libre Form plugin version 1.5.0.2 or later, which addresses this vulnerability by enforcing strict file type validation on uploads.","detection":"Look for HTTP POST requests to the plugin’s upload endpoint (e.g., /wp-content/plugins/wp-libre-form/upload.php or similar) containing a .php file in the multipart form-data, followed by subsequent GET/POST requests to that uploaded PHP file from the same or different IP address; also monitor for creation of unexpected .php files in publicly accessible web directories such as wp-content/uploads.","tags":["rce","file-upload","unauthenticated","web","wordpress"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:43:38.707Z"}}