Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

SimpleForm plugin lets anyone upload malicious files

CVE-2026-118235 · published 4 days ago
Summary

The SimpleForm form‑maker plugin for WordPress (up to version 3.10.2) does not properly check uploaded file names, so a visitor can upload a file with a trailing dot to bypass restrictions. This could let an attacker place executable code on your site and potentially take control. Update the plugin to a patched version or remove it until a fix is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wpazleen simpleform – form maker to chat apps with quiz, poll and multi lead notifications <= 3.10.2
Original advisory text
SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published31 Oct 2026
Updated2 Nov 2026
First seen31 Oct 2026
Sources
CVE-2026-118235 · NVD
CVE-2026-118235 · MITRE
Track software like this
Free during beta