CVE-2026-104748 wpazleen CVE debrief

Who should care

WordPress administrators and users of the SimpleForm plugin should assess their exposure and prioritize updating to a fixed version. This involves reviewing the current version of the SimpleForm plugin, identifying all instances where the plugin is used, and ensuring that updates are applied to all affected systems. Additionally, defenders should verify the version of the SimpleForm plugin and update to a fixed version. They should also monitor for any new

Why it matters

CVE-2026-104748 is a critical vulnerability in the SimpleForm plugin for WordPress that allows unauthenticated attackers to escalate privileges and create new Administrator-level accounts. WordPress administrators and users of the SimpleForm plugin should assess their exposure and prioritize updating to a fixed version.

• Attackers can create new Administrator-level WordPress accounts.
• Unauthenticated attackers can escalate privileges.
• The vulnerability allows for the creation of new accounts with elevated privileges.
• Defenders should verify the version of the SimpleForm plugin and update to a fixed version.

Technical summary

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to unauthenticated privilege escalation. The `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacks a capability check for role assignment, and the `save_custom_fields_to_user_meta()` function uses an exclusion list that omits `wp_capabilities`. This allows attackers to create new Administrator-level WordPress accounts by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The vulnerability exists in SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications versions up to and including 3.10.0. The nonce required by the endpoint is .

Defensive priority

High

Recommended defensive actions

• Update SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications to a version greater than 3.10.0.
• Restrict access to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action.
• Monitor for suspicious account creation activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists in SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications versions up to and including 3.10.0. The `wp_ajax_nopriv_simpleform_wp_register` AJAX action does not perform a capability check for role assignment, and the `save_custom_fields_to_user_meta()` function uses an exclusion list that omits `wp_capabilities`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.