by Kastro
Paper/Archive/CVE-2026-118423

CVE-2026-118423

Unknown WP Libre Form — WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

CVSS 10.0
critical.is priorityof 100
30
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Affected

ProductAffectedFixed inSource
WP Libre Form1.5.0.1 – 1.5.0.1–CNA

Scores by source

WPScan (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/35149a79-aee1-4f13-ba29-583c2224c5da