WordPress Plugin Vulnerabilities

MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE

Description

The plugin does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.

Proof of Concept

Affects Plugins

Plugin icon
magicform
No known fix

References

CVE
CVE-2026-9815
URL
https://wordpress.org/plugins/magicform/

Miscellaneous

Original Researcher
0xBassia
Submitter
0xBassia
Submitter website
https://github.com/0xBassia
Submitter twitter
MohamedBassia
Verified
Yes
WPVDB ID
043f449f-fc65-4218-83d2-7742e62f2af3

Timeline

Publicly Published
2026-05-28 (about 2 months ago)
Added
2026-05-28 (about 2 months ago)
Last Updated
2026-07-29 (about 4 hours ago)

Other

Published
Title
Published
2024-10-24
Title
SurveyJS: Drag & Drop WordPress Form Builder < 1.12.4 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2026-05-01
Title
User Registration Advanced Fields < 1.6.21 - Unauthenticated Arbitrary File Upload
Published
2018-01-06
Title
LearnDash < 2.5.4 - Unauthenticated Arbitrary File Upload
Published
2014-08-01
Title
RokBox <= 2.13 - thumb.php src Parameter Arbitrary File Upload
Published
2025-08-21
Title
Portfolio Manager Pro 3.8 - Unauthenticated Arbitrary File Upload