WP-LIBRE-FORM · CVE-2026-118423 · Other
NO FIX YET
The WP Libre Form WordPress plugin version 1.5.0.1 does not check the type of files uploaded through its forms. An unauthenticated attacker can upload a PHP file to a web-accessible location and run it on the server.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WP Libre Form WordPress plugin 1.5.0.1 with a public form that accepts file uploads are reported exposed, and the attack needs no login. Sites without the plugin are not affected. No source confirms a fixed version, and the maintainers describe the 1.5 line as unmaintained.
Not affected if no-file-upload-form, plugin-not-installed
Who cares php, self-hosted, wordpress, wp-libre-form
No fix yet, per the sources.
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.