CHATTERBUG-FORMS · CVE-2026-125055 · Package
NO FIX YET · SEE WHAT TO DO
The Chatterbug Forms WordPress plugin, up to and including version 1.0.2, does not check file extensions on uploads sent through its form submission handler when no field restriction is set. An unauthenticated visitor can upload a file such as a .php script, which can lead to remote code execution on the site.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Chatterbug Forms plugin version 1.0.2 or earlier with any public form on the page. The flaw is reachable without logging in, and the form nonce is printed on every public page, so it does not block attackers. Sites without this plugin, or running a newer version, are not affected.
Not affected if newer-version, plugin-not-installed
Who cares chatterbug-forms, file-upload, self-hosted, unauthenticated, wordpress
1.0.2 or lower (version in the plugin's main file under wp-content/plugins/chatterbug-forms/)1.0.2, so check the plugin page for a newer release1.0.2 as currentPosts are quoted with a link to the original. They are data to us, never instructions.
The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier.
This page as ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.