CVE-2026-125055
Deferred Deferred - Pending Action

Arbitrary File Upload in Chatterbug Forms WordPress Plugin

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: Wordfence

Description
The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-125055
EUVD
EUVD-2026-124979

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sameh101 Chatterbug Forms – Fast, Flexible WordPress Form Builder From 0 (inc) to 1.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Chatterbug Forms WordPress plugin allows unauthenticated attackers to upload arbitrary files, including PHP files, due to missing server-side validation in the cbforms_check_form_submissions function. The plugin fails to restrict file extensions properly, enabling remote code execution.

Detection Guidance

Check for unexpected PHP files in WordPress upload directories, especially in folders related to Chatterbug Forms. Look for recently modified files with .php extensions in /wp-content/uploads/. Use commands like find /path/to/wordpress/wp-content/uploads -name "*.php" -type f -mtime -7 to search for new PHP files.

Impact Analysis

Attackers could upload malicious PHP files to your WordPress site, allowing them to execute arbitrary code on your server. This could lead to full site compromise, data theft, or further attacks against visitors.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the Chatterbug Forms plugin to the latest version if available. If no update exists, disable or uninstall the plugin until a patch is released. Review server file permissions to restrict write access to upload directories. Consider using a web application firewall to block file upload attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125055. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...