PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9815 MagicForm CVE debrief

The MagicForm WordPress plugin through version 0.1.3 has a critical vulnerability that allows unauthenticated attackers to upload PHP files and execute arbitrary code on the server. This occurs when a form's per-field extension allowlist is left empty and the plugin fails to properly validate the type of files uploaded through an unauthenticated AJAX action. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. Users of the MagicForm WordPress plugin, especially those who have not updated to a patched version, should be aware of this vulnerability and take immediate action to prevent exploitation.

Vendor
MagicForm
Product
MagicForm
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-18
Original CVE updated
2026-06-22
Advisory published
2026-06-18
Advisory updated
2026-06-22

Who should care

Users of the MagicForm WordPress plugin, especially those who have not updated to a patched version, should be aware of this vulnerability. Unauthenticated attackers could exploit this to upload malicious PHP files and execute arbitrary code on the server, potentially leading to full control of the affected system.

Technical summary

The MagicForm WordPress plugin through version 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty. This allows unauthenticated attackers to upload PHP files and execute arbitrary code on the server. The vulnerability is characterized by a CVSS score of 6.5 and a severity of MEDIUM. To exploit this vulnerability, an attacker would need to upload a malicious PHP file through the unauthenticated AJAX action, which would then be executed on the server. This could lead to full control of the affected system.

Defensive priority

Medium priority should be given to updating the MagicForm WordPress plugin to a version that addresses this vulnerability. In the meantime, users should ensure that all file uploads are properly validated and that the plugin's configuration does not allow for unauthenticated file uploads.

Recommended defensive actions

  • Update the MagicForm WordPress plugin to the latest version.
  • Review and restrict file upload permissions for unauthenticated AJAX actions.
  • Implement additional monitoring for suspicious file upload activity.
  • Consider temporarily disabling the plugin if an immediate update is not possible.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-06-18T08:16:34.590Z and was last modified on 2026-06-22T18:38:02.507Z. The NVD entry is currently Deferred. Limited details are available about the specific exploits or attacks related to this vulnerability.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-18T08:16:34.590Z and has not been modified since then. The NVD entry is currently Deferred.