{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/simpleform--form-maker-to-chat-apps-with-quiz-poll-and-multi-lead-notifications--3.10.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:simpleform_project:simpleform:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-104748"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications (\u003c= 3.10.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress, in versions up to and including 3.10.0, contains a critical privilege escalation vulnerability. The \u003ccode\u003ewp_ajax_nopriv_simpleform_wp_register\u003c/code\u003e AJAX action fails to perform capability validation for role assignment during user registration. Furthermore, the \u003ccode\u003esave_custom_fields_to_user_meta()\u003c/code\u003e function improperly excludes user meta fields, failing to filter \u003ccode\u003ewp_capabilities\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eBecause \u003ccode\u003eget_form_settings()\u003c/code\u003e returns a hard-coded defaults array that enables meta writing, an unauthenticated attacker can supply \u003ccode\u003ewp_capabilities[administrator]=1\u003c/code\u003e within registration requests. The nonce required for this action is exposed in the \u003ccode\u003efront_end_data\u003c/code\u003e JavaScript object, which is publicly accessible to any site visitor. This flaw allows attackers to bypass registration controls and gain full administrative access to affected WordPress instances.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an unauthenticated attacker full administrative privileges on the target WordPress site. This leads to complete site compromise, including the ability to execute arbitrary PHP code, modify site content, access sensitive database information, and pivot to the underlying host or associated infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the SimpleForm plugin to a version beyond 3.10.0.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user lists for unauthorized administrator accounts, specifically looking for accounts created recently via the SimpleForm registration flow.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests directed toward \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e containing the \u003ccode\u003eaction=simpleform_wp_register\u003c/code\u003e parameter, specifically inspecting payloads for \u003ccode\u003ewp_capabilities\u003c/code\u003e fields.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T08:23:08Z","date_published":"2026-10-14T08:23:08Z","id":"https://feed.craftedsignal.io/briefs/2026-10-simpleform-privilege-escalation/","summary":"The SimpleForm plugin for WordPress (\u003c= 3.10.0) is vulnerable to unauthenticated administrator account creation due to missing capability checks on the wp_ajax_nopriv_simpleform_wp_register AJAX action.","title":"Unauthenticated Privilege Escalation in SimpleForm WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-simpleform-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - SimpleForm – Form Maker to Chat Apps With Quiz, Poll and Multi Lead Notifications (\u003c= 3.10.0)","version":"https://jsonfeed.org/version/1.1"}