Arbitrary file upload in SimpleForm WordPress plugin
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The SimpleForm WordPress plugin is vulnerable in all versions up to and including 3.10.2. The handle_upload function accepts a trailing-dot filename that bypasses its extension and MIME checks (CWE-434). An unauthenticated attacker who obtains the nonce printed in public form pages can upload executable files, which may lead to remote code execution.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpazleen | SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications | up to 3.10.2 | — | No fix listed | CNA |
- SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications Vendorwpazleen Affected up to 3.10.2 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for SimpleForm.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Timeline
- 2026-10-31 Threatist record created from CVE-2026-118235
- 2026-10-31 Alias added: GHSA-wjww-5gvr-r96j
- 2026-11-02 CISA SSVC decision points changed
References
Other 9
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6aac2178-f6ce-4444-9afc-7e014547cd48?source=cve
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L142
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L118
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L137
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L988
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L67
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L973
- https://plugins.svn.wordpress.org/simple-form/trunk/
- https://plugins.trac.wordpress.org/changeset/3770697/simple-form/trunk/app/FileUpload.php
More wpazleen vulnerabilities
- TI-2026-73817 SimpleForm Unauthenticated Privilege Escalation via wp_capabilities CVSS 3.1CRITICAL 9.8
- TI-2026-11366 Unrestricted file upload in wpazleen Post Export Import with Media CVSS 3.1HIGH 7.2
- TI-2026-73821 Post Export Import with Media: Authenticated PHP Object Injection CVSS 3.1HIGH 7.2
- TI-2026-76039 Path traversal in Post Export Import with Media WordPress plugin CVSS 3.1MEDIUM 4.9
- TI-2026-70261 Path traversal in Post Export Import with Media allows file reads CVSS 3.1MEDIUM 4.9
Sources
- CVE-2026-118235 · CVE Program
- CVE-2026-118235 · NVD
- FIRST EPSS
- GHSA-wjww-5gvr-r96j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences