SimpleForm WordPress plugin: Unauthenticated arbitrary file upload
Summary
The SimpleForm WordPress plugin up to and including version 3.10.2 contains an arbitrary file upload flaw in the handle_upload function. A trailing dot in the filename bypasses the extension and MIME validation, so an unauthenticated attacker can upload files that may be executable, which could lead to remote code execution. The only check is a nonce that is printed into every public form, so any visitor to a page with an embedded form can obtain it.
Affected
- SimpleForm WordPress plugin, versions 3.10.2 and earlier (CVE text: all versions up to and including 3.10.2)
- VulDB also lists 3.10.0 and 3.10.1 as affected
- Only sites with a SimpleForm form embedded on a public page are reachable via this route (research notes, not verified)
Fixed in
Unknown. No vendor fix or patched version has been confirmed for this CVE.
Workaround
- Deactivate the plugin or remove forms that contain a file upload field until a fix is confirmed
- Block script execution in the plugin's upload directory at web-server level
- Use a WAF or virtual patch if available (not verified for this CVE)
Exploitation
- Exploitation in the wild: Not known (per OffSeq, not verified against CISA KEV)
- Public proof-of-concept: None found in the research
- VulDB exploit price estimate: USD 0-5k
Our recommendation
- Inventory all WordPress sites for SimpleForm and check whether version 3.10.2 or earlier is installed
- Where a file upload field is in use, deactivate or disable it now
- Check the uploads folder for unexpected or executable files and review admin accounts for signs of web shells
- Monitor the Wordfence advisory and the WordPress.org changelog for a fixed version and update immediately once available
- Treat the severity as Critical (CVSS 9.8 by the CNA; VulDB rates 7.3)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence advisory www.wordfence.com
- VulDB CVE-2026-118235 vuldb.com
- OffSeq threat radar radar.offseq.com
- WordPress.org plugin page wordpress.org
- Trac FileUpload.php (tag 3.10.2) plugins.trac.wordpress.org
- Trunk changeset 3770697 (FileUpload.php) plugins.trac.wordpress.org
- Patchstack related CVE-2026-104748 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:20.
Original description (NVD)
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.
NVD references (9)
- https://plugins.svn.wordpress.org/simple-form/trunk/
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L67
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L973
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L988
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L118
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L137
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L142
- https://plugins.trac.wordpress.org/changeset/3770697/simple-form/trunk/app/FileUpload.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6aac2178-f6ce-4444-9afc-7e014547cd48?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.