IvyForms Plugin: Arbitrary file upload vulnerability (CVE-2026-109384)
The Innovative Form Builder - IvyForms plugin for WordPress contains an arbitrary file upload vulnerability via the filterFiletypeAndExt function.
CVE search metadata
CVE search record: CVE-2026-109384. Severity: high. CVSS: 8.8. EPSS: 0.73%. KEV: no. Brief: IvyForms Plugin: Arbitrary file upload vulnerability (CVE-2026-109384). Brief link: https://feed.craftedsignal.io/briefs/2026-10-ivyforms-rce/
Triage facts
Revision 2- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 2Oct 30, 23:05 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_vendors, claim_state, cves, has_poc, lastmod, poc_references, references, updates
Sources: 1
The Innovative Form Builder - IvyForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.5.1. The vulnerability is caused by insufficient file type validation in the filterFiletypeAndExt function, which overrides native WordPress defenses. An authenticated attacker with 'add_edit_forms' capability or above can configure a form to accept dangerous file extensions, allowing unauthenticated visitors to upload executable files via the /wp-json/ivyforms/v1/form/submission/ REST route, potentially leading to remote code execution.