CVE-2026-125055: Chatterbug Forms <= 1.0.2 - Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission
The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbformscheckformsubmissions function. This is due to missing server-side file extension validation in cbformscheckformsubmissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote visitor can exploit it if they can access a public page containing a Chatterbug form. The form submission nonce is exposed inline on those public pages and is not an effective access-control mechanism.
Are all plugin installations affected by default?
The vulnerable behavior occurs when an upload field has no configured file-type restriction. In that case, the server accepts the extension supplied by the uploaded file, including potentially executable extensions such as .php.
What is the likely impact of a successful upload?
An attacker may upload files that are executable by the server, making remote code execution possible. The reported impact includes complete compromise of confidentiality, integrity, and availability.
How can I determine whether my site is exposed?
Check whether Chatterbug Forms is installed at version 1.0.2 or earlier and whether any publicly accessible form includes a file-upload field without a configured allowed file-type restriction. Publicly reachable forms with such fields can be submitted without authentication.