Critical Severity
CVE-2026-118423
Published: Nov 13, 2026
Sable Research — Analysis of CVE-2026-118423: Unauthenticated Arbitrary File Upload to RCE in WP Libre Form (≤ 1.5.0.1)
# CVE-2026-118423 — Unauthenticated Arbitrary File Upload leading to RCE in WP Libre Form
## Summary
CVE-2026-118423 is a critical unauthenticated arbitrary file upload vulnerability in the **WP Libre Form** WordPress plugin (version ≤ 1.5.0.1).
The plugin fails to validate the file type of uploads submitted through its public forms. An unauthenticated attacker can upload a malicious PHP file that is stored in a web-accessible directory (`wp-content/uploads/`), resulting in remote code execution under the privileges of the web server user.
**CVSS v3.1 Score:** 10.0 (Critical)
**Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
**CWE:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
---
## Affected Software
| Product | Affected Versions | Fixed Version |
|----------------------|-------------------|---------------|
| WP Libre Form | ≤ 1.5.0.1 | Not available (as of 2026-11-06) |
---
## Technical Overview
WP Libre Form registers the AJAX action `wplf_submit` for both authenticated and unauthenticated users (`wp_ajax_nopriv_wplf_submit`).
When a form is submitted and is not configured to use the WordPress media library, uploaded files are moved directly into the uploads directory using a predictable naming scheme:
```
lf_<ymdhs>-<counter>-<original_filename>
```
`sanitize_file_name()` does not strip the `.php` extension. As a result, a PHP payload becomes directly executable by the web server.
The only requirement is a publicly accessible form that uses the `[libre-form]` shortcode.
---
## Impact
Successful exploitation allows an unauthenticated remote attacker to:
- Execute arbitrary code on the server
- Fully compromise the WordPress installation
- Pivot further into the underlying host (depending on server configuration)
---
## Mitigation Recommendations
Until an official patch is released, the following temporary measures are strongly advised:
1. **Disable or remove** the WP Libre Form plugin im