A critical privilege escalation flaw in the SimpleForm WordPress plugin lets unauthenticated attackers register a new Administrator-level account, affecting all versions up to and including 3.10.0.
What Is It
CVE-2026-104748 is a privilege escalation vulnerability (CWE-269) in the SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress. Wordfence reported it, and it was published to NVD on 2026-10-14.
Three weaknesses combine to cause the flaw:
- The
wp_ajax_nopriv_simpleform_wp_registerAJAX action does not check capabilities when it assigns a role. save_custom_fields_to_user_meta()filters fields with an exclusion list that leaves outwp_capabilities.get_form_settings()returns a hard-coded defaults array that always enables meta writing, whateverform_idis supplied.
As a result, an attacker can add wp_capabilities[administrator]=1 to standard registration fields and create a new Administrator account.
Why It Matters
The flaw is rated CVSS 3.1 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is reachable over the network, takes little effort to exploit, and needs no privileges or user interaction.
The endpoint's nonce does not slow an attacker down. The plugin adds it to the front_end_data JavaScript object on every front-end page via wp_enqueue_scripts, so any unauthenticated visitor can read it before sending the request. An attacker with an administrator account controls the whole WordPress site.
KEV status: The supplied CISA KEV entry is empty. This CVE is not listed in KEV, so CISA has not confirmed active exploitation, and there is no CISA required-action deadline.
What's Vulnerable
- Vendor: wpazleen
- Product: SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications (WordPress plugin)
- Affected versions: All versions up to and including 3.10.0
The NVD record is in "Received" status and lists no CPEs.
Patch Status
The NVD record does not name a fixed version. It does link a WordPress plugin Trac changeset (3726513) that modifies app/Integrations/WordPressAuth.php in the plugin trunk, which points to an upstream code fix. Administrators running SimpleForm 3.10.0 or earlier should:
- Check the Wordfence advisory and the plugin's release history for a patched release.
- Update as soon as a release newer than 3.10.0 is available.
- If they cannot update, consider disabling the plugin.
- Review user accounts for unexpected Administrator-level users.
Sources
- NVD – CVE-2026-104748
- Wordfence Threat Intel Advisory
- WordPress Plugin Trac – Changeset 3726513 (WordPressAuth.php)
- WordPress Plugin Trac – WordPressAuth.php (3.10.0, L32)
- WordPress Plugin Trac – WordPressAuth.php (3.10.0, L184)
- WordPress Plugin Trac – WordPressAuth.php (3.10.0, L291)
- WordPress Plugin Trac – Assets.php (3.10.0, L265)
- WordPress Plugin SVN – simple-form trunk