IT SBIT Services
Schneeberger
DEEN
CVE tracker

IvyForms WordPress plugin: Arbitrary file upload leading to possible remote code execution

CVE-2026-109384High 8.8Public exploit

← All vulnerabilities

Summary

The IvyForms form builder plugin for WordPress up to and including 1.5.1 fails to validate uploaded file types properly, allowing dangerous extensions such as php to be permitted in File Upload fields. An attacker with the custom add_edit_forms capability can configure such a field and publish the form; afterwards, any anonymous visitor can upload files through the public REST route /wp-json/ivyforms/v1/form/submission/, which may enable remote code execution on the web server. The vulnerability is rated high (CVSS 8.8).

Affected

  • IvyForms plugin for WordPress, all versions up to and including 1.5.1
  • Precondition: an account with the custom add_edit_forms capability and a published form with a File Upload field allowing dangerous extensions

Fixed in

  • Version 1.5.2 (according to the vendor's release notes and the WordPress.org changelog; the code fix has not been independently verified)

Workaround

  • Upgrade to 1.5.2 where possible; no workaround is documented if patching is not immediately possible
  • Review all IvyForms forms for File Upload fields that permit dangerous extensions such as php, phtml or exe, and remove them
  • Restrict the custom form-management capability to trusted staff only

Exploitation

  • No evidence of exploitation in the wild found; not listed in CISA KEV at the time of research
  • No public proof of concept found
  • CISA SSVC: exploitation none, automatable no, technical impact total
  • Unknown beyond this; re-check CISA KEV and vendor sources

Our recommendation

  • Update IvyForms to version 1.5.2 or later on all WordPress sites without delay
  • Check whether any IvyForms form has a File Upload field that allows dangerous file extensions, and remove such fields
  • Review which accounts hold the add_edit_forms capability and limit it to trusted staff
  • Scan the web server for unexpected PHP or other executable files and monitor upload directories and REST API requests to /wp-json/ivyforms/

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:40.

Original description (NVD)

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the allowed-extensions sanitizer and deliberate override of WordPress's native MIME and extension defences via a registered wp_check_filetype_and_ext filter. This makes it possible for authenticated attackers, with custom-level access and above, to upload files that may be executable, which makes remote code execution possible. An authenticated attacker with the custom add_edit_forms capability must first configure a File Upload field with a dangerous extension (e.g., php) in the allowed-extensions list; once that form is published, any unauthenticated visitor can trigger the actual file upload via the publicly accessible /wp-json/ivyforms/v1/form/submission/ REST route.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed