WordPress Plugin Vulnerabilities

WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

Description

The plugin does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Proof of Concept

Affects Plugins

Plugin icon
wp-libre-form
No known fix

References

CVE
CVE-2026-118423

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
10.0 (critical)

Miscellaneous

Original Researcher
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
35149a79-aee1-4f13-ba29-583c2224c5da

Timeline

Publicly Published
2026-11-03 (about 3 days ago)
Added
2026-11-03 (about 2 days ago)
Last Updated
2026-11-03 (about 2 days ago)

Other

Published
Title
Published
2026-03-16
Title
ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 - Unauthenticated Remote Code Execution
Published
2024-08-23
Title
Image Hotspot by DevVN < 1.2.6 - Authenticated (Author+) PHP Object Injection
Published
2025-01-03
Title
Dynamics 365 Integration < 1.3.24 - Contributor+ RCE and Arbitrary File Read
Published
2024-06-20
Title
Consulting Elementor Widgets < 1.3.1 - Authenticated (Contributor+) Remote Code Execution
Published
2025-12-23
Title
Print Invoice & Delivery Notes for WooCommerce < 5.9.0 - Unauthenticated Remote Code Execution