CVE-2026-118423 WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
CriticalCVSS 10.0
EPSS 0.57%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress wp-libre-form(WordPress) | <= 1.5.0.1 | No fix listed |
References
- wpscan.com exploit technical-description vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org