CVE-2026-118423: WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

Published Nov 6, 2026

Updated

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Event History

Nov 6, 2026

CVE Published

via MITRE·07:30 AM

Data Sourced

via MITRE·07:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated attackers can exploit it; no login or WordPress account is required.

What does an attacker need to do to gain code execution?

The attacker needs to submit a PHP file through the plugin's form upload functionality. Because uploaded files can be placed in a web-accessible location, the attacker can then execute the uploaded PHP code.

How can I determine whether an attempted compromise may have occurred?

Review files uploaded through WP Libre Form submissions, especially for PHP files in web-accessible upload locations. Also investigate web requests that access recently uploaded PHP files.

CVE-2026-118423: WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to gain code execution?

How can I determine whether an attempted compromise may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to gain code execution?

How can I determine whether an attempted compromise may have occurred?