CVE-2026-10818
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
| CWE | CWE-434 |
| Vendor | wpforms |
| Product | wpforms pro |
| Published | Jul 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for wpforms wpforms pro
Be the first to know when new high vulnerabilities affecting wpforms wpforms pro are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
WPForms / WPForms Pro
0 ≤ 1.10.1.1
References
Credits
lhking