CVE-2026-104748

Deferred Deferred - Pending Action

Privilege Escalation in SimpleForm WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104748

EUVD

EUVD-2026-100911

Affected Vendors & Products

Vendor	Product	Version / Range
wpazleen	SimpleForm	– Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This WordPress plugin vulnerability allows unauthenticated attackers to create an Administrator account by exploiting missing capability checks in the registration process. Attackers can send a malicious request with wp_capabilities[administrator]=1 to gain full control of the WordPress site.

Detection Guidance

Check WordPress sites using the SimpleForm plugin up to version 3.10.0 for unauthorized admin accounts. Inspect AJAX requests to wp_ajax_nopriv_simpleform_wp_register for missing capability checks. Review user registration logs for suspicious admin account creations via the exposed nonce in front_end_data.

Impact Analysis

An attacker could take over your WordPress site, install malware, steal data, or deface the site. Since it requires no authentication, any visitor could exploit it if the plugin is installed and outdated.

Compliance Impact

This vulnerability allows unauthenticated attackers to create an Administrator-level WordPress account, granting full control over the site. This could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA compliance by exposing personal or health information without consent or proper safeguards.

Mitigation Strategies

Update the SimpleForm plugin to the latest version beyond 3.10.0 immediately. If an update is unavailable, consider disabling or removing the plugin until a patch is released. Review WordPress user accounts for unauthorized Administrator-level accounts and remove any suspicious entries.

Hi! I’m here to help you understand CVE-2026-104748. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70