Live › vulnerability › CVE-2026-109384
Go to dashboardThe IvyForms form builder plugin for WordPress, through version 1.5.1, lets file upload fields accept dangerous extensions such as php because its allowed-extensions check has no denylist and overrides WordPress's own file type checks. An attacker who can configure a form can get a PHP file onto the server through the public submission REST route, which can lead to remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running IvyForms 1.5.1 or earlier with a File Upload field published on a form. The exposure depends on an account with the custom add_edit_forms capability configuring a dangerous extension, after which any visitor can submit the upload through the public REST route. Sites without IvyForms, or without File Upload fields, can skip it.
No product ranges from the sources yet.
1.5.1 or lower in the WordPress plugins list or wp plugin list1.5.1 once a patched release is available; the sources do not name the fixed versionadd_edit_forms capability assignmentsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the allowed-extensions sanitizer and deliberate override of WordPress's native MIME and extension defences via a registered wp_check_filetype_and_ext filter. This makes it possible for authenticated attackers, with custom-level access and above, to upload files that may be executable, which makes remote code execution possible. An authenticated attacker with the custom add_edit_forms capability must first configure a File Upload field with a dangerous extension (e.g., php) in the allowed-extensions list; once that form is published, any unauthenticated visitor can trigger the actual file upload via the publicly accessible /wp-json/ivyforms/v1/form/submission/ REST route.
This page as .md · .json · in your agent: get_signal("CVE-2026-109384")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.