Cve-2026-118235 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-118235/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 11:56:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSimpleForm: Arbitrary file upload remote code execution (CVE-2026-118235)https://feed.craftedsignal.io/briefs/2026-10-simpleform-rce/Sat, 31 Oct 2026 11:56:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-simpleform-rce/An unauthenticated remote code execution vulnerability in the SimpleForm WordPress plugin (<= 3.10.2) allows attackers to bypass file validation via trailing-dot filenames and exploit publicly exposed nonces.The SimpleForm plugin for WordPress is vulnerable to arbitrary file upload (CVE-2026-118235) due to a flaw in the 'handle_upload' function. The vulnerability allows unauthenticated attackers to bypass extension and MIME type validation by utilizing filenames ending with a dot. Furthermore, the nonce required for the upload request is printed in the data-nonce attribute of every public form, enabling unauthenticated access. Successful exploitation can lead to remote code execution.

Impact

Successful exploitation allows unauthenticated attackers to upload executable files to the WordPress server, potentially resulting in full system compromise via remote code execution.

Recommendation

Update the 'SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications' plugin to a version released after 3.10.2. Until patching is completed, consider disabling the plugin or restricting access to the associated upload endpoints if the site functionality permits.

]]>criticaladvisorywordpresspluginremote-code-executionfile-uploadcve-2026-118235