CVE-2026-118235
Received Received - Intake

Arbitrary File Upload in SimpleForm WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-118235
EUVD
EUVD-2026-114672

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin allows unauthenticated attackers to upload arbitrary files due to missing server-side file key allowlist and pre-sanitization extension derivation. A trailing-dot filename bypasses all extension and MIME validation in the handle_upload function. This enables remote code execution because uploaded files may be executable.

Detection Guidance

Check WordPress sites using the SimpleForm plugin up to version 3.10.2. Look for unexpected file uploads in directories where forms are active. Review server logs for POST requests to handle_upload with unusual filenames or extensions.

Impact Analysis

Attackers can upload malicious executable files to your WordPress site, potentially gaining full control over it. This could lead to website defacement, data theft, or the site being used to attack other systems. The vulnerability requires no authentication, making it easy for attackers to exploit.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. Organizations may face fines or penalties for failing to secure user data adequately.

Mitigation Strategies

Immediately update the SimpleForm plugin to the latest patched version. Disable file uploads in forms if not required. Implement server-side file extension and MIME type validation. Restrict write permissions on upload directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118235. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart