CVE-2026-109384: Arbitrary upload in IvyForms WordPress

CVE-2026-109384 affects the WordPress plugin IvyForms in all versions up to and including 1.5.1. The vulnerability lies in the absence of a dangerous-extension denylist in the filterFiletypeAndExt function and deliberate override of WordPress's native MIME and extension validation mechanisms. This allows unauthenticated visitors to upload executable files via the public REST API endpoint /wp-json/ivyforms/v1/form/submission/, provided a site administrator has previously enabled dangerous extensions (e.g., .php) in the form.

The vulnerability has a CVSS score of 8.8 (high). The most critical signal is the availability of a public proof-of-concept on GitHub since October 30, 2026 (two days after NVD publication on October 28), indicating imminent exploitation potential. The exploit requires no authentication and is accessible to any web visitor regardless of role.

WordPress site administrators using IvyForms must verify the installed version immediately. If version 1.5.1 or earlier, updating to the security patch is the absolute priority. If the update is not immediately feasible, disabling the plugin reduces risk. Reviewing access logs for /wp-json/ivyforms/* REST API for suspicious uploads and auditing uploaded files are recommended actions to identify prior exploitation.