External risk intelligence

WP Libre Form Unauthenticated PHP File Upload Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-118423

The vulnerability exists in a WordPress plugin that handles form submissions and file uploads. Such forms are designed to be public-facing and internet-accessible by default to receive input from website visitors, making the vulnerable endpoint reachable to any unauthenticated user on the internet.

Remote Code Execution

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a popular WordPress plugin allows unauthenticated attackers to upload and execute malicious code, potentially leading to full website compromise. This issue affects the WP Libre Form plugin and could enable attackers to take control of your website.

Unauthenticated attackers can run code on your website.
It allows remote code execution via file uploads.
Confirm if this plugin is used and exposed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by targeting a WordPress website using the vulnerable plugin. Since no authentication is required, the attacker can submit a form and upload a malicious PHP file. This file can then be executed by accessing it directly through the web server, potentially allowing the attacker to run arbitrary code on the server.

Unauthenticated access to a form submission.
Uploading and executing a PHP file.
Remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to upload and execute arbitrary PHP files on a web server when supported by the advisory. This could lead to the compromise of the affected website and its underlying infrastructure.

Website files and server code.
Uploading malicious PHP files.
Remote code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WP Libre Form plugin's vulnerability to unauthenticated remote code execution necessitates immediate action from teams responsible for website content management systems and application security. The first step is to identify all WordPress instances utilizing this plugin, confirm their exposure to the internet, and determine their business criticality. Subsequently, the accountable owner should be identified to plan and execute remediation, prioritizing high-risk assets.

Website owners should own this issue.
Verify plugin usage and internet exposure.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP Libre Form plugin?

WP Libre Form is a WordPress plugin designed to handle visitor interactions, specifically form submissions. Users install it to collect data through custom forms on their websites. This vulnerability exists within the component responsible for processing file uploads attached to those forms.

What does CVE-2026-118423 mean for website security?

This is an unrestricted file upload vulnerability. The software fails to verify the file type during submission, allowing someone to upload executable PHP code instead of expected document formats. Because the server treats these uploaded files as valid code, it leads to remote code execution, giving an attacker control over the server environment.

How does an attacker trigger this vulnerability?

An attacker interacts with a publicly accessible form created by the plugin to upload a malicious PHP file. This does not require a user account or special permissions. Simply submitting the form is sufficient to save the file to a web-accessible location. The bug is not triggered by standard form inputs like text fields; it is specifically the misuse of the file upload feature.

Why is this vulnerability highly relevant to my website?

According to Halo Surface Signal, this plugin is designed to be public-facing to receive input from visitors. Because the vulnerable endpoint is reachable by anyone on the internet without authentication, your website is likely exposed if you have this plugin active on an internet-facing WordPress instance.

What should I do if I use WP Libre Form?

Start by identifying every WordPress instance where this plugin is installed. Verify if the plugin is currently enabled and if the associated forms are accessible to the public. If you confirm the plugin is in use, determine the business importance of those sites to prioritize your response, and coordinate with the site owners to plan for updates or removal.

References

wpscan.com/vulnerability/35149a79-aee1-4f13-ba29-583c2224c5da/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.