CVE-2026-10818: Unauthenticated File Upload in WPForms Pro
TL;DR - CVE-2026-10818 affects WPForms Pro through 1.10.1.1. - Unauthenticated attackers may upload executable files, leading to possible RCE. - Patch immediately to a version newer than 1.10.1.1 and monitor uploads now.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-10818 |
| CVSS | 8.1 (High) |
| Attack vector | Network |
| Privileges required | None |
| Patch available | Yes, but the exact fixed version was not confirmed from the retrieved primary-source content. Defenders should upgrade to the first vendor release after 1.10.1.1 and verify via official WPForms changelog or advisory. |
This is a high-severity arbitrary file upload vulnerability in the WPForms Pro plugin for WordPress. The issue is notable because it is exploitable without authentication and can potentially lead to remote code execution if an uploaded file lands in a web-accessible location and the server executes that file type.
The strongest confirmed facts come from the NVD record: the flaw affects all versions up to and including 1.10.1.1, involves the ajax_chunk_upload_finalize function, and stems from file type validation taking place only after the file data has already been written to disk. If validation fails, the assembled file is not removed. That sequence materially raises operational risk for exposed WordPress sites using WPForms Pro.
What Is This Vulnerability?
CVE-2026-10818 is an arbitrary file upload flaw in WPForms Pro’s chunked upload handling. According to the NVD description, the vulnerable logic occurs in ajax_chunk_upload_finalize. The problem is not simply that validation is weak; it is that validation occurs too late in the workflow. By the time file type checks happen, chunk metadata and file contents have already been written to disk.
That ordering matters. In secure upload flows, the application should validate file type, extension, MIME expectations, and storage policy before a potentially dangerous artifact becomes reachable on disk. Here, the final assembled file may remain present even when validation fails, because the application does not delete it after detecting the problem. In practice, that can allow an attacker to leave behind a file the application nominally rejects.
The practical impact depends on server configuration, upload path behavior, and how WordPress and the web server handle uploaded content. If the resulting file is web-accessible and executable by the platform, the flaw can become a remote code execution path. Even where direct execution is blocked, arbitrary file upload still creates serious risk, including stored payload staging, persistence, and abuse of other local processing paths.
Technical Notes
A simplified vulnerable sequence looks like this:
1. Attacker sends chunked upload data
2. Server assembles and writes file to disk
3. Server validates file type after write
4. Validation fails
5. Assembled file is not deleted
6. Dangerous file remains on disk
Conceptually, the risky logic pattern is:
// Pseudocode to illustrate the flaw pattern
write_chunk_metadata($request);
append_uploaded_chunk_to_file($tmp_path);
if (!is_allowed_file_type($tmp_path)) {
// validation fails, but file already exists
return error_response("Disallowed file type");
}
// missing cleanup of the already-written file on failure
Who Is Affected?
The confirmed affected product is WPForms Pro plugin for WordPress. The confirmed affected version range is all versions up to and including 1.10.1.1. That range comes directly from the NVD record and is the strongest available primary-source version statement in the research set.
At the time of writing, the exact fixed version number was not confirmed from retrieved vendor advisory content. That means defenders should avoid overstating the patch target. The safe operational guidance is to treat 1.10.1.1 and earlier as vulnerable, then upgrade to the first vendor release after 1.10.1.1 that addresses the issue, verifying the exact version against official WPForms changelog material before using it in compliance documentation or external reporting.
Any WordPress site running WPForms Pro in the affected range should be considered at risk, especially if the site accepts public form submissions or exposes file upload functionality through forms. Internet-facing business sites, customer portals, marketing sites with lead forms, and SMB WordPress deployments are all relevant exposure candidates. Because the issue is unauthenticated, defenders should assume an attacker does not need a valid account to attempt exploitation.
A second exposure factor is hosting configuration. Sites are at highest risk where uploaded files or temporary assemblies can be directly reached over HTTP or where the web stack may execute uploaded script content. Even if your environment blocks direct execution in upload directories, do not dismiss the issue. Residual uploaded files can still support follow-on exploitation, staging, and compromise attempts.
CVSS Score Breakdown
The NVD base score is 8.1 High. The exact CVSS vector string was not returned in the available tool output, so defenders should not assume unverified sub-metrics beyond what is clearly supported by the vulnerability description. Still, several score components are reasonably inferable from the confirmed facts.
First, the attack vector is network-based because exploitation occurs over web application functionality. Second, privileges required are none because the flaw is explicitly described as exploitable by unauthenticated attackers. Third, the potential impact is high because arbitrary file upload that can lead to remote code execution typically threatens confidentiality, integrity, and availability of the WordPress application and underlying content.
What remains less certain without the explicit vector string is the exact NVD scoring treatment for user interaction, scope, and the individual CIA impact ratings. In the absence of the vector, practitioners should focus on the operational meaning of the 8.1 score rather than overfitting assumptions. For defenders, the key takeaway is straightforward: an internet-reachable, unauthenticated file upload flaw with possible code execution deserves urgent remediation regardless of whether exploitation in the wild has been confirmed.
A useful way to read the score in practice is this: CVSS is high enough to prioritize patching over routine maintenance windows, but not so precise that you should delay action waiting for fuller scoring metadata. If you run WPForms Pro in the vulnerable range, your patch and monitoring teams should treat this as a near-term response item.
Exploitation Status
Based on the available research, active exploitation in the wild is not confirmed. Specifically, the CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog at the time of research. That means there is no CISA-backed confirmation of in-the-wild exploitation from this evidence set.
Likewise, a public proof of concept was not confirmed in the reviewed material. Searches did not surface a verified public exploit repository specific to CVE-2026-10818, and the GitHub advisory result encountered appeared to refer to a different WPForms-related issue rather than this CVE. As a result, the most accurate statement is: no confirmed public PoC identified from the retrieved sources.
That said, absence of confirmation is not absence of risk. The vulnerability class, exposure conditions, and attack prerequisites make this a plausible target for rapid weaponization. Unauthenticated arbitrary file upload vulnerabilities are often attractive to opportunistic scanning and exploitation campaigns because they can lead directly to shell upload and site takeover. Defenders should assume exploit development is feasible even if no public PoC has been found yet.
From an incident response perspective, the right posture is: patch as if exploitation is imminent, not because it is confirmed, but because the barrier to attacker value is low and the blast radius can be high on a compromised WordPress host.
How to Detect It
Detection should focus on three areas: suspicious requests targeting WPForms upload endpoints, unexpected files appearing in WordPress upload paths or temporary directories, and signs of execution or access to newly written server-side scripts. Because public technical exploit details were not confirmed, defenders should rely on behavior-based detection rather than a single IOC.
Start by reviewing web server and WordPress logs around form submission and upload activity. Look for anonymous clients making repeated chunked upload requests followed by access to unusual files in upload locations. Any appearance of executable extensions, double extensions, or PHP content under media or temporary upload paths should be treated as suspicious. If you have EDR on the web host, alert on web server worker processes spawning shells, interpreters, or unexpected child processes.
You should also baseline the normal upload behavior of WPForms in your environment. If your site rarely accepts public file uploads, then any upload finalization activity tied to anonymous users should be reviewed. In environments where uploads are expected, tune detections around disallowed extensions, mismatched content types, and post-upload GET requests to newly created files.
Technical Notes
Example file system hunt for suspicious uploaded executables under WordPress content paths:
find /var/www/html/wp-content -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" -o -name "*.php5" \) -printf "%TY-%Tm-%Td %TT %p\n" | sort
Example grep for common suspicious patterns in web logs:
grep -E "wpforms|upload|chunk|finalize|multipart/form-data" /var/log/nginx/access.log
grep -E "\.php(\?|$)|\.phtml(\?|$)|/wp-content/uploads/" /var/log/nginx/access.log
Illustrative detection logic for SIEM, adapted to your log schema:
SELECT timestamp, src_ip, http_method, uri, status, user_agent
FROM web_logs
WHERE (
uri ILIKE '%wpforms%'
AND (uri ILIKE '%upload%' OR uri ILIKE '%chunk%' OR uri ILIKE '%finalize%')
)
OR uri ILIKE '%/wp-content/uploads/%.php%'
ORDER BY timestamp DESC;
Illustrative network or log patterns worth reviewing:
POST /...wpforms... HTTP/1.1
Content-Type: multipart/form-data; boundary=...
POST requests with chunk/finalize semantics from unauthenticated clients
followed by
GET /wp-content/uploads/.../*.php
GET /wp-content/uploads/.../*.phtml
If your stack logs file creation events, hunt for files created shortly before validation or application errors. Since the core issue involves a file remaining on disk after failed validation, the combination of an upload-related error and a new file artifact is a meaningful lead.
Mitigation and Patching
The primary remediation is to upgrade WPForms Pro immediately to a version newer than 1.10.1.1. Because the exact fixed version was not confirmed from retrieved primary-source content, do not publish an exact patched version number unless you have independently verified it from the official WPForms changelog or a vendor security notice. In change management records, document that 1.10.1.1 is the last confirmed vulnerable version from NVD and that the deployed target must be a vendor release after that version.
If immediate upgrading is not possible, reduce exposure. Disable public-facing file upload forms that rely on WPForms Pro, restrict access to affected forms, and enforce web server controls that prevent script execution from upload directories. Also review filesystem permissions and ensure upload paths cannot run PHP or similar server-side code. These are compensating controls, not substitutes for patching.
Because exploitation may leave files behind even when validation fails, mitigation should include a post-patch hunt. Review recent uploads, temporary directories, and web-accessible content paths for unexpected server-side scripts or newly created executable files. If you find suspicious artifacts, assume possible compromise and escalate to incident response.
Technical Notes
Check the currently installed plugin version from WordPress CLI:
wp plugin list | grep -i wpforms
Upgrade the plugin using WP-CLI if your licensing and deployment method support it:
wp plugin update wpforms --path=/var/www/html
If your environment deploys plugins through a managed artifact or admin UI instead of WP-CLI, update WPForms Pro to the first vendor release after 1.10.1.1 and record the exact package version installed.
As a temporary hardening measure, prevent PHP execution in common upload locations. For Apache using .htaccess in the upload directory:
<FilesMatch "\.(php|phtml|phar|php5)$">
Require all denied
</FilesMatch>
For Nginx, block script execution from uploads:
location ~* ^/wp-content/uploads/.*\.(php|phtml|phar|php5)$ {
deny all;
return 403;
}
Temporary operational workaround steps:
1. Disable WPForms file upload fields on public forms
2. Restrict form access to authenticated users where feasible
3. Inspect wp-content uploads and temp paths for executable files
4. Patch to a version newer than 1.10.1.1
5. Re-scan and review logs for prior abuse
References
The most authoritative source for the vulnerability description and affected range is the NVD record for CVE-2026-10818. That record states the issue affects WPForms Pro through 1.10.1.1, is exploitable without authentication, and can make remote code execution possible because file validation occurs after content is written and failed validation does not remove the assembled file.
CISA’s Known Exploited Vulnerabilities catalog did not list this CVE at the time of research, so there is no CISA confirmation of exploitation in the wild from the available source set. Vendor-facing verification material includes WPForms’ official site and official changelog documentation page, but the exact fixed version number was not recoverable from the retrieved content and therefore should be treated as unconfirmed until independently verified.
For further information on related vulnerabilities, you can check out the following articles: What is a Zero-Day? and Palo Alto Exploited Chrome Zero-Day Patched and Critical CVEs.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.