Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

SimpleForm plugin lets anyone create admin account

CVE-2026-104748 · published 21 days ago
Summary

The SimpleForm form‑maker plugin for WordPress (versions up to 3.10.0) allows anyone on the internet to register a new user with administrator rights. It does this because the registration request does not verify the user’s role and the security token is publicly visible. Update the plugin to a newer version or remove the plugin until it is patched, and monitor your site for unauthorized admin accounts.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wpazleen simpleform – form maker to chat apps with quiz, poll and multi lead notifications <= 3.10.0
Original advisory text
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published14 Oct 2026
Updated4 Nov 2026
First seen14 Oct 2026
Sources
CVE-2026-104748 · NVD
CVE-2026-104748 · MITRE
Track software like this
Free during beta