---
id: "CVE-2026-125055"
page: "https://infrastack.ai/live/CVE-2026-125055"
kind: "vulnerability"
aliases: ["CVE-2026-125055"]
title: "Chatterbug Forms WordPress plugin lets anonymous visitors upload PHP files"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "chatterbug-forms", "fixed": [], "affected": "<= 1.0.2", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["chatterbug-forms", "file-upload", "package", "self-hosted", "unauthenticated", "wordpress"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-11-13T10:17:28+00:00"
first_seen_at: "2026-11-13T10:47:11+00:00"
updated_at: "2026-11-13T10:49:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125055", "first_seen_at": "2026-11-13T10:47:11+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chatterbug-forms", "first_seen_at": "2026-11-13T10:49:03+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chatterbug-forms", "https://wordpress.org/plugins/chatterbug-forms/"]}]
exploit_sources: []
---

# Chatterbug Forms WordPress plugin lets anonymous visitors upload PHP files

Link for people: https://infrastack.ai/live/CVE-2026-125055 (this .md is for agents)

The Chatterbug Forms WordPress plugin, up to and including version 1.0.2, does not check file extensions on uploads sent through its form submission handler when no field restriction is set. An unauthenticated visitor can upload a file such as a .php script, which can lead to remote code execution on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:chatterbug-forms affected <= 1.0.2 fixed no fixed version listed

## How to check

In WordPress admin > Plugins, check whether Chatterbug Forms is installed and at version 1.0.2 or lower (version in the plugin's main file under wp-content/plugins/chatterbug-forms/). Look in wp-content/uploads and the form upload directories for unexpected .php files. Wordfence marks it patched but names no fixed version; WordPress.org still lists 1.0.2, so check the plugin page for a newer release.

## Fix

Unknown: Wordfence lists the issue as patched but no fixed version is published; WordPress.org shows 1.0.2 as current. Update if a newer version appears, otherwise deactivate and remove the plugin.

## Timeline

- 2026-11-13T10:47:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125055
- 2026-11-13T10:49:03+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chatterbug-forms — Wordfence lists CVE-2026-125055 (CVSS 9.8, <=1.0.2, status Patched, researcher samathakeeling, 30 active installs). WordPress.org still shows 1.0.2 as current (changelog 'Initial release', modified Nov 10), so no fixed version is confirmed; Wordfence's 'Patched' may mean a vendor update not yet visible. No exploitation or PoC found. Nothing verified.

## Documents

- [advisory] Wordfence: Chatterbug Forms <= 1.0.2 unauthenticated arbitrary file upload https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chatterbug-forms
- [describes] Chatterbug Forms on WordPress.org https://wordpress.org/plugins/chatterbug-forms/

## From the sources

The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_