---
id: "CVE-2026-109384"
kind: "vulnerability"
aliases: ["CVE-2026-109384"]
title: "WordPress IvyForms plugin: file upload accepts PHP files, enabling code execution"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ivyforms", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-file-upload-fields", "patched-version", "plugin-not-installed"]
published_at: "2026-10-28T07:16:44+00:00"
first_seen_at: "2026-10-28T07:31:37+00:00"
updated_at: "2026-10-28T07:32:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109384", "first_seen_at": "2026-10-28T07:31:37+00:00"}]
---

# WordPress IvyForms plugin: file upload accepts PHP files, enabling code execution

The IvyForms form builder plugin for WordPress, through version 1.5.1, lets file upload fields accept dangerous extensions such as php because its allowed-extensions check has no denylist and overrides WordPress's own file type checks. An attacker who can configure a form can get a PHP file onto the server through the public submission REST route, which can lead to remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the IvyForms plugin is installed and its version is `1.5.1` or lower in the WordPress plugins list or `wp plugin list`
- Look for published forms with a File Upload field whose allowed extensions include php or other executable types
- Check the web server upload directories for unexpected .php files

## Fix

- Update the IvyForms plugin to a version later than `1.5.1` once a patched release is available; the sources do not name the fixed version
- Until patched, deactivate the plugin or remove File Upload fields from published forms
- Delete any unexpected PHP files found in upload directories and review the `add_edit_forms` capability assignments

## Timeline

- 2026-10-28T07:31:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109384

## From the sources

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the allowed-extensions sanitizer and deliberate override of WordPress's native MIME and extension defences via a registered wp_check_filetype_and_ext filter. This makes it possible for authenticated attackers, with custom-level access and above, to upload files that may be executable, which makes remote code execution possible. An authenticated attacker with the custom add_edit_forms capability must first configure a File Upload field with a dangerous extension (e.g., php) in the allowed-extensions list; once that form is published, any unauthenticated visitor can trigger the actual file upload via the publicly accessible /wp-json/ivyforms/v1/form/submission/ REST route.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_