CVE-2026-118423

WP Libre Form remote code execution via unrestricted form file upload

critical · 10.0

WP Libre Form

Published Nov 6, 2026, 07:30 UTC

Description

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.