/Vulnerability Library

WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Upload

CVE-2026-10818
Verified

Description

WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpforms_upload_chunk_init, wpforms_upload_chunk and wpforms_file_chunks_uploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under wp-content/uploads/wpforms/tmp/ before file extension and MIME type validation happens, so a rejected upload never removes the already written file. An unauthenticated attacker can plant arbitrary files and, depending on server configuration, achieve remote code execution.

Severity

High

CVSS Score

8.1

Exploit Probability

2%

Affected Product

wpforms

Published Date

September 30, 2026

Template Author

i-am-paradox

CVE-2026-10818.yaml
8.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-10818
CWE ID:
cwe-434

References

https://github.com/Nxploited/CVE-2026-10818https://nvd.nist.gov/vuln/detail/CVE-2026-10818

Remediation Steps

Update WPForms Pro to a version later than 1.10.1.1.