IT SBIT Services
Schneeberger
DEEN
CVE tracker

SimpleForm WordPress plugin: Unauthenticated privilege escalation to administrator

CVE-2026-104748Critical 9.8Public exploit

← All vulnerabilities

Summary

The SimpleForm form builder plugin for WordPress, up to and including version 3.10.0, allows unauthenticated visitors to create WordPress accounts with administrator rights. The registration AJAX action does not restrict role assignment, so a crafted request that sets wp_capabilities creates an administrator account. The required nonce is publicly visible on every front-end page, and according to the CVE record the default configuration is affected, so no login or special setup is needed.

Affected

  • SimpleForm WordPress plugin, all versions up to and including 3.10.0
  • Default configuration: affected according to the CVE record

Fixed in

  • Version 3.10.1 according to the WordPress.org changelog (not yet confirmed against the Wordfence advisory)

Workaround

  • Deactivate and remove the plugin until it is updated
  • Disable open user registration in WordPress (Settings > General > Membership) if it is not needed
  • Consider a WAF rule for the simpleform_wp_register action, but do not rely on it alone

Exploitation

  • Public proof-of-concept code exists on GitHub (two repositories)
  • CISA SSVC assessment lists exploitation as none; the CVE is not listed in the KEV catalog
  • Active exploitation in the wild: Unknown

Our recommendation

  • Update SimpleForm to version 3.10.1 or later immediately, and verify the fix against the Wordfence advisory
  • Check all WordPress sites for this plugin and its version
  • Review the administrator user list for unknown accounts and investigate any sites where the plugin was exposed
  • Disable the plugin on sites where an update is not possible yet
  • Monitor for new administrator accounts and unexpected changes

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:02.

Original description (NVD)

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed