CVE-2026-118423
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
CVSS Score
10.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
| Vendor | unknown |
| Product | wp libre form |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp libre form
Be the first to know when new critical vulnerabilities affecting unknown wp libre form are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / WP Libre Form
1.5.0.1 ≤ 1.5.0.1
References
Credits
Enrico Marcolini Claudio Marchesini Dottor Marc WPScan