CVE-2026-118423

Summary

The WP Libre Form plugin version 1.5.0.1 lacks file type validation during uploads, permitting unauthenticated users to upload and execute arbitrary PHP files, resulting in remote code execution (RCE).

Exploitability

Exploitation is trivial for unauthenticated attackers due to the absence of authentication, authorization, or input validation on file uploads.

Blast radius

Successful exploitation grants full remote code execution with web server privileges, enabling complete compromise of confidentiality, integrity, and availability of the affected system and potentially downstream infrastructure.

Detection

Look for HTTP POST requests to the plugin’s upload endpoint (e.g., /wp-content/plugins/wp-libre-form/upload.php or similar) containing a .php file in the multipart form-data, followed by subsequent GET/POST requests to that uploaded PHP file from the same or different IP address; also monitor for creation of unexpected .php files in publicly accessible web directories such as wp-content/uploads.

Prioritized remediation

Upgrade to WP Libre Form plugin version 1.5.0.2 or later, which addresses this vulnerability by enforcing strict file type validation on uploads.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.