CVE-2026-118235 is a critical (CVSS 9.8) arbitrary file upload flaw in the SimpleForm WordPress plugin through version 3.10.2 that lets unauthenticated attackers upload potentially executable files, making remote code execution possible.
What Is It
The bug is in the handle_upload function of the SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress. Wordfence reported it, and it is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type).
The record lists two root causes:
- The server does not check file keys against an allowlist.
- The plugin works out the file extension before it sanitizes the filename. A filename ending in a dot can therefore get past all extension and MIME validation in
handle_upload.
The only access control is a nonce. That nonce is printed into the data-nonce attribute of every public form, so any visitor to a page that embeds the form shortcode can read it. In practice, the endpoint has no authentication.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- It can be exploited over the network.
- Attack complexity is low.
- No privileges or user interaction are needed.
- Confidentiality, integrity, and availability impact are all high.
If attackers can upload executable files to a web server, they may be able to run code on it and take over the WordPress site.
Exploitation status: No CISA KEV entry was supplied for this CVE, so the provided data does not confirm active exploitation. The NVD record was published on 2026-10-31 and still has the status "Received."
What's Vulnerable
- Vendor: wpazleen
- Product: SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications (WordPress plugin)
- Affected versions: all versions up to and including 3.10.2
- Exposure condition: any site with a public page that embeds the form shortcode, since that page exposes the nonce
Patch Status
The supplied data does not name a fixed version. The NVD references include WordPress plugin changeset 3770697, which modifies app/FileUpload.php in the plugin trunk. This suggests a fix is being made in the code, but the records do not say whether it has shipped in a tagged release.
No CISA KEV required action or due date applies, because there is no KEV entry. Administrators running SimpleForm 3.10.2 or earlier should check the Wordfence advisory and the plugin repository for a release later than 3.10.2, and update as soon as one is available.