PatchSiren cyber security CVE debrief
CVE-2026-10818 WPForms CVE debrief
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The vulnerability has a CVSS score of 8.1 and is considered HIGH severity.
- Vendor
- WPForms
- Product
- WPForms Pro
- CVSS
- HIGH 8.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-25
- Original CVE updated
- 2026-07-25
- Advisory published
- 2026-07-25
- Advisory updated
- 2026-07-25
Who should care
Users of the WPForms Pro plugin for WordPress should be aware of this vulnerability and take immediate action to protect their installations. This vulnerability affects users who have not updated to a patched version of the plugin. WPForms Pro plugin users should review their installations and ensure they are running a version that is not vulnerable.
Technical summary
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The vulnerability has a CVSS score of 8.1 and is considered HIGH severity.
Defensive priority
High
Recommended defensive actions
- Update WPForms Pro plugin to the latest version
- Restrict file uploads to only trusted users
- Monitor for suspicious file uploads
- Implement additional security measures such as Web Application Firewall (WAF) rules
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-25T07:17:08.880Z and has not been modified since then. The NVD entry is currently 8.1 HIGH. The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Evidence is limited to public CVE and NVD information.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-25T07:17:08.880Z and has not been modified since then.