High Severity
CVE-2026-104748
Published: Oct 25, 2026
Unauthenticated privilege escalation in SimpleForm WordPress plugin <= 3.10.0. Registers an administrator account without authentication
<h1 align="center">SimpleForm <= 3.10.0 Unauthenticated Privilege Escalation (CVE-2026-104748)</h1>
<p align="center">
<img src="https://api.visitorbadge.io/api/visitors?path=https%3A%2F%2Fgithub.com%2Fjoshuavanderpoll%2FCVE-2026-104748&label=Views&countColor=%2337d67a" />
<a href="https://www.python.org/">
<img src="https://img.shields.io/badge/python-%23FFDF76.svg?style=for-the-badge&logo=python&logoColor=black" alt="Python">
</a>
</p>
## Description
CVE-2026-104748 is an unauthenticated privilege escalation in the SimpleForm WordPress plugin (<= 3.10.0). Three weaknesses combine: the AJAX registration handler has no capability check, `wp_capabilities` is absent from the exclusion list in `save_custom_fields_to_user_meta()`, and `get_form_settings()` always returns `save_custom_fields_to_user_meta => true`. The nonce required to call the endpoint is publicly exposed on every frontend page via `wp_localize_script()`. Any unauthenticated request can register a WordPress Administrator account.
**Affected versions:** SimpleForm (WordPress plugin) <= 3.10.0
## Features
- Registers an unauthenticated administrator account
- Non-breaking vulnerability check (`--check`): confirms exposure without creating an account
- Fingerprints WordPress version, server, PHP, and SimpleForm version from existing responses
- Single target (`-t`) or target list from file (`-l`)
## OSX/Linux
```bash
git clone https://github.com/joshuavanderpoll/CVE-2026-104748.git
cd CVE-2026-104748
python3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements.txt
```
## Windows
```bash
git clone https://github.com/joshuavanderpoll/CVE-2026-104748.git
cd CVE-2026-104748
python3 -m venv .venv
.venv\Scripts\activate
pip3 install -r requirements.txt
```
## Usage
```
python3 cve-2026-104748.py [-h] (-t TARGET | -l FILE) [-u USERNAME] [-e EMAIL]
[-p PASSWORD] [--check] [-os OS]
[-useragent USERAGENT] [-timeout T