Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Piotnet Forms for WordPress allows attackers to upload any file type

CVE-2026-4883 · published 5 months ago
Summary

The Piotnet Forms plugin for WordPress doesn't properly check the type of files being uploaded, which means an attacker can upload any type of file. This could allow an attacker to execute malicious code on the site. To fix this, update the plugin to the latest version or remove it if you're not using it.

Original advisory text
The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all versions up to, and includi...
The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all versions up to, and including, 2.1.40. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published19 May 2026
Updated3 Nov 2026
First seen19 May 2026
Sources
CVE-2026-4883 · NVD
Track software like this
Free during beta