CVE-2026-10818 WPForms CVE debrief

Who should care

Users of the WPForms Pro plugin for WordPress should be aware of this vulnerability and take immediate action to protect their installations. This vulnerability affects users who have not updated to a patched version of the plugin. WPForms Pro plugin users should review their installations and ensure they are running a version that is not vulnerable.

Technical summary

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The vulnerability has a CVSS score of 8.1 and is considered HIGH severity.

Defensive priority

High

Recommended defensive actions

• Update WPForms Pro plugin to the latest version
• Restrict file uploads to only trusted users
• Monitor for suspicious file uploads
• Implement additional security measures such as Web Application Firewall (WAF) rules
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-25T07:17:08.880Z and has not been modified since then. The NVD entry is currently 8.1 HIGH. The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Evidence is limited to public CVE and NVD information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.