Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:simpleform:simpleform:*:*:*:*:*:wordpress:*:*

1 brief RSS
critical advisory

SimpleForm: Arbitrary file upload remote code execution (CVE-2026-118235)

An unauthenticated remote code execution vulnerability in the SimpleForm WordPress plugin (<= 3.10.2) allows attackers to bypass file validation via trailing-dot filenames and exploit publicly exposed nonces.

SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications wordpress plugin remote-code-execution file-upload cve-2026-118235
1r 1t 1c