{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-109384/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-109384"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=0E088B39-334A-5856-81AD-68E4971B7EA2\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","remote-code-execution","arbitrary-file-upload","cve-2026-109384"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Innovative Form Builder - IvyForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.5.1. The vulnerability is caused by insufficient file type validation in the filterFiletypeAndExt function, which overrides native WordPress defenses. An authenticated attacker with 'add_edit_forms' capability or above can configure a form to accept dangerous file extensions, allowing unauthenticated visitors to upload executable files via the /wp-json/ivyforms/v1/form/submission/ REST route, potentially leading to remote code execution.\u003c/p\u003e\n","date_modified":"2026-10-30T23:04:47Z","date_published":"2026-10-28T08:27:14Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ivyforms-rce/","summary":"The Innovative Form Builder - IvyForms plugin for WordPress contains an arbitrary file upload vulnerability via the filterFiletypeAndExt function.","title":"IvyForms Plugin: Arbitrary file upload vulnerability (CVE-2026-109384)","url":"https://feed.craftedsignal.io/briefs/2026-10-ivyforms-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-109384","version":"https://jsonfeed.org/version/1.1"}