SimpleForm: Arbitrary file upload remote code execution (CVE-2026-118235)
An unauthenticated remote code execution vulnerability in the SimpleForm WordPress plugin (<= 3.10.2) allows attackers to bypass file validation via trailing-dot filenames and exploit publicly exposed nonces.
CVE search metadata
CVE search record: CVE-2026-118235. Severity: critical. CVSS: 9.8. KEV: no. Product: SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications (<= 3.10.2). Brief: SimpleForm: Arbitrary file upload remote code execution (CVE-2026-118235). Brief link: https://feed.craftedsignal.io/briefs/2026-10-simpleform-rce/
Triage facts
Revision 1- Applicability
- SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications (<= 3.10.2)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 11:56 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The SimpleForm plugin for WordPress is vulnerable to arbitrary file upload (CVE-2026-118235) due to a flaw in the 'handle_upload' function. The vulnerability allows unauthenticated attackers to bypass extension and MIME type validation by utilizing filenames ending with a dot. Furthermore, the nonce required for the upload request is printed in the data-nonce attribute of every public form, enabling unauthenticated access. Successful exploitation can lead to remote code execution.
Impact
Successful exploitation allows unauthenticated attackers to upload executable files to the WordPress server, potentially resulting in full system compromise via remote code execution.
Recommendation
Update the 'SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications' plugin to a version released after 3.10.2. Until patching is completed, consider disabling the plugin or restricting access to the associated upload endpoints if the site functionality permits.
Immediate actions
Patch SimpleForm plugin to a version > 3.10.2
Threat Hunt
Search web logs for POST requests to the SimpleForm handle_upload function combined with suspicious file extensions or trailing dot anomalies.
Data: web_server_access_logs
Mitigations
Upgrade SimpleForm plugin to the latest secure version.
CVE-2026-118235
Detection coverage 1
Detects CVE-2026-118235 Exploitation - Arbitrary File Upload via SimpleForm
criticalDetects potential exploitation of CVE-2026-118235 by identifying file upload requests containing filenames ending with a dot, which is a known bypass technique for the handle_upload function.
Detection queries are available on the platform. Get full rules →