home / blog
2026-11-06 · critical
CVE-2026-118423: RCE in WP Libre Form WordPress Plugin 1.5.0.1
WP Libre Form 1.5.0.1 does not validate file uploads: unauthenticated RCE. CVSS 10.0 critical.
CVE-2026-118423 affects the WordPress plugin WP Libre Form in version 1.5.0.1. The flaw resides in the lack of file type validation during form submissions through the plugin. Unauthenticated attackers can upload PHP files directly to web-accessible locations and instruct the server to execute them, achieving full remote code execution on the system.
The severity is maximum: the CVSS score is 10.0, confirmed as critical. The flaw was published on NVD on 2026-11-06. As of today, according to available data, no official patch exists. Public signals show two posts on X in the last 24 hours discussing the absence of a fix, with a total of 7 interactions. No publicly declared exploits on GitHub repositories have been reported.
If WP Libre Form is installed on managed sites, it must be disabled immediately until a patch is available. Review web server access logs for suspicious POST requests to the plugin's upload paths and check uploaded files for anomalous PHP scripts. Regularly monitor the plugin's official repository and vendor communication channels for fix announcements.
At a glance
- What
- WP Libre Form WordPress plugin version 1.5.0.1 does not validate the type of files uploaded through its forms. Unauthenticated attackers upload PHP files to web-accessible locations and execute code on the server remotely.
- Severity
- CVSS 10.0 (critical). The vulnerability enables unauthenticated remote code execution on any affected plugin installation.
- Affected versions
- WP Libre Form 1.5.0.1
- Fix
- Not yet available according to verified public signals. Monitor the official plugin channel for updates.
- Status
- Published on NVD 2026-11-06. Declared severity: critical. Two posts on X in 24 hours, seven total interactions. No publicly declared GitHub exploit.
- Action
- If the plugin is installed, disable it immediately. Check access logs and uploaded files for traces of suspicious PHP uploads. Monitor the version for security patches.
Sources: NVD, CVE-2026-118423