CVE-2026-104748: SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the wpajaxnoprivsimpleformwpregister AJAX action lacking any capability check for role assignment and the savecustomfieldstousermeta() function using an exclusion list that omits wpcapabilities, combined with getformsettings() returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied formid. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying wpcapabilities[administrator]=1 alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the frontenddata JavaScript object on every front-end page via wpenqueuescripts, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor can exploit it remotely. The required nonce is publicly exposed in front-end JavaScript on every front-end page, so no existing WordPress account or special access is needed.
What does an attacker need to submit to gain administrator access?
The attacker can submit standard registration fields together with wp_capabilities[administrator]=1 to the unauthenticated registration AJAX action. This causes creation of a new WordPress account with Administrator-level capabilities.
Are sites affected regardless of the form being targeted?
Yes. The form-settings logic returns hard-coded defaults that unconditionally enable user-meta writing regardless of the supplied form_id, so the vulnerable behavior is not limited to a particular configured form.
How can I tell whether exploitation may have occurred?
Review WordPress user accounts for unexpected newly created Administrator-level accounts. Also inspect registration activity associated with the unauthenticated simpleform_wp_register AJAX action and requests containing wp_capabilities[administrator]=1.