Zero Radar
← feed
CriticalVulnerabilityCVE-2026-118235updated 31 Oct 2026, 13:30 UTC

SimpleForm WordPress plugin lets anyone upload executable files

Visitors to a page with a SimpleForm form can upload files that the website server may run as programs. That can let an outsider take control of the website.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker finds formPublic page embeds the form shortcode
  2. 2Nonce read from pageNonce is printed in data-nonce attribute
  3. 3Trailing-dot file uploadDot bypasses extension and MIME checks
  4. 4Server stores executable filehandle_upload accepts the file
  5. 5Attacker runs codeUploaded file may execute on the server
  6. ResultAttacker may run code on the server

What happened

The SimpleForm WordPress plugin's handle_upload function fails to block uploads with a trailing dot in the filename, which bypasses extension and MIME checks. The only protection is a nonce printed in every public form, so unauthenticated users can obtain it and upload files.

Why it is dangerous: Unauthenticated attackers can upload potentially executable files, which may enable remote code execution on the WordPress server. Any site running the plugin with a public form is at risk.

Are you affected?

You are affected if you run the SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin version 3.10.2 or earlier on a page that embeds its form shortcode.

SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications (WordPress plugin), all versions up to and including 3.10.2

What to do

  1. Check whether the SimpleForm plugin is installed and its version is 3.10.2 or earlier
  2. Deactivate the SimpleForm plugin or remove its forms from public pages until a fixed version is confirmed
  3. Review the uploads folder for unexpected or executable files and remove any you do not recognize
  4. Watch the official plugin source for an update and install it as soon as it is released

Timeline

  1. 31 Oct 2026, 09:16 UTC
    Publicly disclosed
  2. 31 Oct 2026, 09:16 UTC
    Reported by NVD · NVD
  3. 31 Oct 2026, 09:18 UTC
    Picked up by Zero Radar
  4. 31 Oct 2026, 13:30 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118235 · GHSA-wjww-5gvr-r96j
CVSS
9.8 / 10
EPSS
0.7% chance of exploitation within 30 days
Disclosed
31 Oct 2026, 09:16 UTC
On Zero Radar
31 Oct 2026, 09:18 UTC (2 min after disclosure)
Last change
31 Oct 2026, 13:30 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

SimpleForm WordPress plugin lets anyone upload executable files · Zero Radar