CVE-2026-10818 | The WPForms Pro plugin for WordPress is vulnerable to Arbitr… | CVSS 8.1 HIGH

Description

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Metadata

CVE ID: CVE-2026-10818
State: PUBLISHED
Assigner: Wordfence
Reserved: 2026-06-04 07:00 UTC
Published: 2026-07-25 06:50 UTC
Last updated: 2026-07-25 06:50 UTC
Primary CWE: CWE-434
CWE-434 Unrestricted Upload of File with Dangerous Type
Vendor / Product: WPForms / WPForms Pro
Sources: cve.org · NVD

Severity & Metrics

8.1 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
WPForms	WPForms Pro	—	0 ≤ 1.10.1.1

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	CWE-434 Unrestricted Upload of File with Dangerous Type

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.1	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)