{"id":"CVE-2026-125055","kind":"vulnerability","aliases":["CVE-2026-125055"],"related":[],"title":"Chatterbug Forms WordPress plugin lets anonymous visitors upload PHP files","description":"The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier.","summary":"The Chatterbug Forms WordPress plugin, up to and including version 1.0.2, does not check file extensions on uploads sent through its form submission handler when no field restriction is set. An unauthenticated visitor can upload a file such as a .php script, which can lead to remote code execution on the site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"chatterbug-forms","fixed":[],"affected":"<= 1.0.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["chatterbug-forms","file-upload","package","self-hosted","unauthenticated","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check whether Chatterbug Forms is installed and at version 1.0.2 or lower (version in the plugin's main file under wp-content/plugins/chatterbug-forms/). Look in wp-content/uploads and the form upload directories for unexpected .php files. Wordfence marks it patched but names no fixed version; WordPress.org still lists 1.0.2, so check the plugin page for a newer release.","fix":"Unknown: Wordfence lists the issue as patched but no fixed version is published; WordPress.org shows 1.0.2 as current. Update if a newer version appears, otherwise deactivate and remove the plugin.","status":"open","published_at":"2026-11-13T10:17:28+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","triaged_at":"2026-11-13T10:48:15+00:00","updated_at":"2026-11-13T10:49:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:48:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Chatterbug Forms WordPress plugin lets anonymous visitors upload PHP files","impact":"high","summary":"The Chatterbug Forms WordPress plugin, up to and including version 1.0.2, does not check file extensions on uploads sent through its form submission handler when no field restriction is set. An unauthenticated visitor can upload a file such as a .php script, which can lead to remote code execution on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","chatterbug-forms","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Anonymous attacker uploads a PHP file and runs code on the server","analyst_note":"Confirm the fixed version and any vendor patch from the plugin's WordPress.org page or the NVD entry; the sources here name only 1.0.2 as vulnerable.","how_to_check":"- Check whether the Chatterbug Forms plugin is installed and its version in the WordPress admin under Plugins.\n- Look for the plugin directory `wp-content/plugins/` and confirm the version in its main plugin file.\n- Review the upload directories the form writes to for unexpected `.php` files.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running the Chatterbug Forms plugin version 1.0.2 or earlier with any public form on the page. The flaw is reachable without logging in, and the form nonce is printed on every public page, so it does not block attackers. Sites without this plugin, or running a newer version, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000781,"input_tokens":4723,"output_tokens":618,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor patch from the plugin's WordPress.org page or the NVD entry; the sources here name only 1.0.2 as vulnerable.","search":"'-125055':13A,16A '-2026':12A,15A '1.0.2':42B,108C 'access':204C 'allow':135C,153C 'allowed-typ':134C 'anonym':6A 'arbitrari':98C 'attack':164C 'barrier':206C 'builder':91C 'cbform':111C,128C 'chatterbug':1A,18A,21B,33B,85C,189C 'chatterbug-form':20B 'chatterbug-forms':17A 'check':45B,112C,129C,137C 'code':79B,175C 'configur':151C 'constitut':201C 'contain':187C 'control':205C 'cve':11A,14A 'default':138C 'due':118C 'effect':203C 'everi':184C 'execut':80B,171C,176C 'extens':47B,125C,145C,155C 'fast':87C 'field':58B,148C 'file':10A,24B,46B,68B,99C,124C,142C,167C 'file-upload':23B 'flexibl':88C 'form':2A,22B,34B,53B,86C,90C,113C,130C,190C 'forms':19A 'freeli':192C 'function':115C 'handler':55B 'host':29B 'includ':40B,107C,156C 'inlin':182C 'lead':76B 'let':5A 'make':159C,173C 'may':169C 'miss':120C 'nonc':180C 'obtain':193C 'packag':26B 'page':186C 'php':9A,72B,157C 'plugin':4A,36B,92C 'possibl':161C,177C 'print':181C 'public':185C 'remot':78B,174C 'restrict':59B,149C 'script':73B 'self':28B 'self-host':27B 'sent':50B 'server':122C 'server-sid':121C 'set':61B 'side':123C 'site':83B 'submiss':54B,114C,131C,179C 'therefor':198C 'trivial':152C 'type':136C 'unauthent':30B,63B,163C,195C 'upload':8A,25B,49B,66B,100C,141C,166C 'valid':126C 'version':41B,103C 'via':109C 'visitor':7A,64B,196C 'vulner':96C 'wordpress':3A,31B,35B,89C,94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Chatterbug Forms plugin version 1.0.2 or earlier with any public form on the page. The flaw is reachable without logging in, and the form nonce is printed on every public page, so it does not block attackers. Sites without this plugin, or running a newer version, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["chatterbugforms"],"ptokens":["chatterbug","forms"],"labels":["chatterbugforms","critical","fileupload","package","selfhosted","unauthenticated","wordpress"],"campaign_type":null,"search_a":"'-125055':13A,16A '-2026':12A,15A 'anonym':6A 'chatterbug':1A,18A 'chatterbug-forms':17A 'cve':11A,14A 'file':10A 'form':2A 'forms':19A 'let':5A 'php':9A 'plugin':4A 'upload':8A 'visitor':7A 'wordpress':3A","search_b":"'1.0.2':42B 'chatterbug':21B,33B 'chatterbug-form':20B 'check':45B 'code':79B 'execut':80B 'extens':47B 'field':58B 'file':24B,46B,68B 'file-upload':23B 'form':22B,34B,53B 'handler':55B 'host':29B 'includ':40B 'lead':76B 'packag':26B 'php':72B 'plugin':36B 'remot':78B 'restrict':59B 'script':73B 'self':28B 'self-host':27B 'sent':50B 'set':61B 'site':83B 'submiss':54B 'unauthent':30B,63B 'upload':25B,49B,66B 'version':41B 'visitor':64B 'wordpress':31B,35B","search_c":"'1.0.2':108C 'access':204C 'allow':135C,153C 'allowed-typ':134C 'arbitrari':98C 'attack':164C 'barrier':206C 'builder':91C 'cbform':111C,128C 'chatterbug':85C,189C 'check':112C,129C,137C 'code':175C 'configur':151C 'constitut':201C 'contain':187C 'control':205C 'default':138C 'due':118C 'effect':203C 'everi':184C 'execut':171C,176C 'extens':125C,145C,155C 'fast':87C 'field':148C 'file':99C,124C,142C,167C 'flexibl':88C 'form':86C,90C,113C,130C,190C 'freeli':192C 'function':115C 'includ':107C,156C 'inlin':182C 'make':159C,173C 'may':169C 'miss':120C 'nonc':180C 'obtain':193C 'page':186C 'php':157C 'plugin':92C 'possibl':161C,177C 'print':181C 'public':185C 'remot':174C 'restrict':149C 'server':122C 'server-sid':121C 'side':123C 'submiss':114C,131C,179C 'therefor':198C 'trivial':152C 'type':136C 'unauthent':163C,195C 'upload':100C,141C,166C 'valid':126C 'version':103C 'via':109C 'visitor':196C 'vulner':96C 'wordpress':89C,94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125055","severity":null,"published_at":"2026-11-13T10:17:28+00:00","modified_at":"2026-11-13T10:17:28+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","fetched_at":"2026-11-13T10:47:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125055:3850","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chatterbug-forms","severity":null,"published_at":"2026-11-13T10:49:03+00:00","modified_at":"2026-11-13T10:49:03+00:00","first_seen_at":"2026-11-13T10:49:03+00:00","fetched_at":"2026-11-13T10:49:03+00:00","note":"Wordfence lists CVE-2026-125055 (CVSS 9.8, <=1.0.2, status Patched, researcher samathakeeling, 30 active installs). WordPress.org still shows 1.0.2 as current (changelog 'Initial release', modified Nov 10), so no fixed version is confirmed; Wordfence's 'Patched' may mean a vendor update not yet visible. No exploitation or PoC found. Nothing verified.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chatterbug-forms","https://wordpress.org/plugins/chatterbug-forms/"]}],"documents":[{"id":145514,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chatterbug-forms","title":"Wordfence: Chatterbug Forms <= 1.0.2 unauthenticated arbitrary file upload","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":145515,"url":"https://wordpress.org/plugins/chatterbug-forms/","title":"Chatterbug Forms on WordPress.org","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}