{"id":"CVE-2026-118423","kind":"vulnerability","aliases":["CVE-2026-118423"],"related":[],"title":"WP Libre Form WordPress plugin: unauthenticated PHP upload leads to code execution","description":"The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.","summary":"The WP Libre Form WordPress plugin version 1.5.0.1 does not check the type of files uploaded through its forms. An unauthenticated attacker can upload a PHP file to a web-accessible location and run it on the server.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-libre-form","fixed":[],"affected":"1.5.0.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["other","php","self-hosted","wordpress","wp-libre-form"],"not_affected_if":["no-file-upload-form","plugin-not-installed"],"how_to_check":"- In WordPress admin > Plugins, check whether WP Libre Form is installed and its version (reported vulnerable: 1.5.0.1; other versions not confirmed by any source).\n- Check the Version line in the plugin header of wp-content/plugins/wp-libre-form/wp-libre-form.php.\n- Check for any form using input type=file and look in wp-content/uploads for unexpected .php files.\n- Until a fix is published, deactivate and remove the plugin, or remove file upload fields and block PHP execution in the uploads directory.","fix":null,"status":"open","published_at":"2026-11-06T08:17:18+00:00","first_seen_at":"2026-11-06T08:40:32+00:00","triaged_at":"2026-11-06T08:42:22+00:00","updated_at":"2026-11-06T08:43:41+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T08:42:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Libre Form WordPress plugin: unauthenticated PHP upload leads to code execution","impact":"high","summary":"The WP Libre Form WordPress plugin version 1.5.0.1 does not check the type of files uploaded through its forms. An unauthenticated attacker can upload a PHP file to a web-accessible location and run it on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wp-libre-form","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs PHP code on the web server remotely.","analyst_note":"Confirm the fixed version and vendor advisory at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-118423); the sources give no fix.","how_to_check":"- Check whether the WP Libre Form plugin is installed and what version is active in the WordPress admin plugin list.\n- Look for the plugin version `1.5.0.1` in the plugin's main file header.\n- Check whether uploaded form files are stored in a web-accessible directory.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-file-upload-form"],"who_is_affected":"Sites running the WP Libre Form WordPress plugin version 1.5.0.1 with a public form that accepts file uploads are exposed, since the attack needs no login. Sites without this plugin, or with it removed, are not affected. The sources do not say whether other versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000714,"input_tokens":4212,"output_tokens":586,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor advisory at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-118423); the sources give no fix.","search":"'-118423':15A,18A '-2026':14A,17A '1.5.0.1':40B,78C 'access':64B,102C 'allow':91C 'attack':54B,93C 'check':43B 'code':11A,110C 'cve':13A,16A 'execut':12A,105C,111C 'file':47B,59B,85C,97C 'form':3A,22A,32B,36B,51B,75C,89C 'host':27B 'lead':9A,107C 'libr':2A,31B,35B,74C 'libre':21A 'locat':65B,103C 'php':7A,24B,58B,96C 'plugin':5A,38B,77C 'remot':109C 'run':67B 'self':26B 'self-host':25B 'server':71B 'submiss':90C 'type':45B,83C 'unauthent':6A,53B,92C 'upload':8A,48B,56B,86C,95C 'valid':81C 'version':39B 'web':63B,101C 'web-access':62B,100C 'wordpress':4A,28B,37B,76C 'wp':1A,20A,30B,34B,73C 'wp-libre-form':19A,29B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Libre Form WordPress plugin 1.5.0.1 with a public form that accepts file uploads are reported exposed, and the attack needs no login. Sites without the plugin are not affected. No source confirms a fixed version, and the maintainers describe the 1.5 line as unmaintained.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wplibreform"],"ptokens":["form","libre","wp"],"labels":["critical","other","php","selfhosted","wordpress","wplibreform"],"campaign_type":null,"search_a":"'-118423':15A,18A '-2026':14A,17A 'code':11A 'cve':13A,16A 'execut':12A 'form':3A,22A 'lead':9A 'libr':2A 'libre':21A 'php':7A 'plugin':5A 'unauthent':6A 'upload':8A 'wordpress':4A 'wp':1A,20A 'wp-libre-form':19A","search_b":"'1.5.0.1':40B 'access':64B 'attack':54B 'check':43B 'file':47B,59B 'form':32B,36B,51B 'host':27B 'libr':31B,35B 'locat':65B 'php':24B,58B 'plugin':38B 'run':67B 'self':26B 'self-host':25B 'server':71B 'type':45B 'unauthent':53B 'upload':48B,56B 'version':39B 'web':63B 'web-access':62B 'wordpress':28B,37B 'wp':30B,34B 'wp-libre-form':29B","search_c":"'1.5.0.1':78C 'access':102C 'allow':91C 'attack':93C 'code':110C 'execut':105C,111C 'file':85C,97C 'form':75C,89C 'lead':107C 'libr':74C 'locat':103C 'php':96C 'plugin':77C 'remot':109C 'submiss':90C 'type':83C 'unauthent':92C 'upload':86C,95C 'valid':81C 'web':101C 'web-access':100C 'wordpress':76C 'wp':73C","first_public_at":"2026-11-06T08:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118423","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118423","severity":null,"published_at":"2026-11-06T08:17:18+00:00","modified_at":"2026-11-06T08:17:18+00:00","first_seen_at":"2026-11-06T08:40:32+00:00","fetched_at":"2026-11-06T08:40:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118423:1874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118423","severity":null,"published_at":"2026-11-06T08:43:41+00:00","modified_at":"2026-11-06T08:43:41+00:00","first_seen_at":"2026-11-06T08:43:41+00:00","fetched_at":"2026-11-06T08:43:41+00:00","note":"NVD page fetched empty; WPScan page unavailable; no vendor advisory or fixed version found. Maintainers' GitHub says 1.5 is unmaintained (2.0 is a rewrite, separate repo libreform/libreform; unconfirmed whether 2.0 is affected). WordPress.org listing shows 1.4.3 and is stale. No exploitation or PoC seen. Nothing verified. Fix stays unknown; settle by reading the WPScan/CNA advisory.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-118423","https://github.com/libreform"]}],"documents":[{"id":84930,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118423","title":"NVD CVE-2026-118423","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":84931,"url":"https://github.com/libreform","title":"WP Libre Form maintainers on GitHub: version 1.5 is unmaintained","kind":"vendor","source":"analyst","publisher":null,"text":"wp-libre-form: Easy native HTML5 forms for WordPress. Version 1.5 is unmaintained, but works without issue. 2.0 has been rewritten from the ground (libreform/libreform).","published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}