Summary
generated automatically from NVD dataThe SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress has an arbitrary file upload flaw (CWE-434) in its handle_upload function, affecting all versions up to and including 3.10.2. A filename with a trailing dot bypasses the extension and MIME validation, and the only access control is a nonce exposed in the data-nonce attribute of every public form. Unauthenticated attackers can therefore upload potentially executable files, which could lead to remote code execution. The CVSS v3.1 score is 9.8 (CRITICAL).
NVD description
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.
EPSS · FIRST.org
0.74%probability of exploitation in the next 30 days
Higher than 54% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-31, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 31 oct. 2026
- Updated
- 31 oct. 2026
- Status
- Received
- Source
- security@wordfence.com
Weaknesses (CWE)
References (9)
Similar CVEs
Other vulnerabilities of type CWE-434
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.