Critical Severity
CVE-2026-109384
Published: Nov 5, 2026
CVE-2026-109384: IvyForms <= 1.5.1 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).
# CVE-2026-109384 — IvyForms <= 1.5.1
**Unauthenticated arbitrary file upload leading to remote code execution (RCE)**
> **Author:** NØXCRYPT · [@noxcrypt-x](https://github.com/noxcrypt-x)
>
> **Disclaimer:** This repository is provided for security research and authorized testing only. Do not use it against systems you do not own or have explicit permission to test. The author is not responsible for any misuse.
>
> **Repository contents:** PoC script and documentation only. The local lab (`lab/`) and plugin sources (`src/`, `src152/`) are not included to keep the repository small.
| | |
|---|---|
| Product | The Innovative Form Builder – IvyForms (WordPress plugin) |
| Affected versions | All versions up to 1.5.1 |
| Fixed in | 1.5.2 (released October 21, 2026) |
| Class | CWE-434 — Unrestricted Upload of File with Dangerous Type |
| CVSS 3.1 | 8.8 High — `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| Source | Wordfence (CNA), published October 27–28, 2026 |
| Identifiers | CVE-2026-109384 / GHSA-qrwx-hpgq-g68q |
---
## 1. Summary
IvyForms lets a form owner — or any user holding the `ivyforms_add_edit_forms` capability, which the plugin exposes as a "custom" access level — choose the allowed file extensions for a `file-upload` field. The extension sanitizer has no denylist, so it accepts `php`, `phtml`, `phar`, and similar script extensions.
On submission, the plugin registers a filter on `wp_check_filetype_and_ext` that forces the allow-listed extension and MIME type, bypassing WordPress's native extension and MIME checks. `wp_handle_upload()` then stores the file under:
```text
wp-content/uploads/ivyforms/entry/<name>.php
```
The `/wp-json/ivyforms/v1/form/submission/` endpoint is public (`permission_callback => '__return_true'`), and the two nonces it requires are printed into the HTML of any page that renders the form. Once the form is configured, an unauthenticated visitor can replay the upload.
**Impact:** webshell upload and execution → full server comp