CVE-2026-125055 is a critical (CVSS 9.8) arbitrary file upload flaw in the Chatterbug Forms WordPress plugin, through version 1.0.2, that can let unauthenticated attackers run code remotely.
What Is It
CVE-2026-125055 is an unrestricted file upload weakness (CWE-434) in the cbforms_check_form_submissions() function of the Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin. The function does not validate file extensions on the server side. If a form field has no file-type restriction, the allowed-type check uses the uploaded file's own extension, so any extension is accepted, including .php.
The plugin does use a submission nonce, but it is printed inline on every public page that contains a Chatterbug form. Any visitor can read it without logging in, so it does nothing to stop an attacker.
Wordfence reported the issue, and NVD published it on 2026-11-13.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- the attack works over the network
- it has low complexity
- it needs no privileges or user interaction
According to the NVD description, unauthenticated attackers can upload files that may be executable, which makes remote code execution possible. An attacker who gets a PHP file onto the server and runs it could read the site's data, including its database and stored credentials. They could also change or deface content, plant a backdoor, or take the site offline.
KEV status: The supplied CISA KEV entry is empty. CISA has not confirmed active exploitation, and there is no KEV-mandated required action or due date.
What's Vulnerable
- Vendor: sameh101
- Product: Chatterbug Forms – Fast, Flexible WordPress Form Builder (WordPress plugin)
- Affected versions: all versions up to and including 1.0.2
- Vulnerable function:
cbforms_check_form_submissions()
Sites with a public Chatterbug form are the easiest to attack, because those pages show the nonce to anyone who visits.
Patch Status
The NVD record links to a WordPress plugin repository changeset (3794492) to the plugin's trunk code. The supplied data does not name a fixed release version. NVD lists the record's status as "Deferred."
Administrators should:
- check the plugin's WordPress.org page and the Wordfence advisory for a release later than 1.0.2 that includes the fix
- update once a fixed release is confirmed
- until then, consider deactivating the plugin or removing public forms that accept file uploads
Sources
- NVD – CVE-2026-125055
- Wordfence Threat Intel advisory
- WordPress Plugin Trac – Changeset 3794492
- WordPress Plugin Trac – chatterbug-forms.php v1.0.2 (L308)
- WordPress Plugin Trac – chatterbug-forms.php v1.0.2 (L331)
- WordPress Plugin Trac – chatterbug-forms.php v1.0.2 (L422)
- WordPress Plugin Trac – chatterbug-forms.php v1.0.2 (L510)