CVE-2026-118423

CriticalCVSS 10.0/10Last modified Nov 6, 2026

Description

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
UnknownWP Libre Form>= 1.5.0.1, <= 1.5.0.1

References

Timeline

Published
Nov 6, 2026
Last modified
Nov 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1184256.8A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurCVE-2026-1184265.3In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user searchCVE-2026-1184355.4Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.CVE-2026-1184373.7The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthCVE-2026-1184386.8The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser,CVE-2026-1184394.1The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a useCVE-2026-118444.9The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Arbitrary File Read vulnerability, allowing privileged remCVE-2026-1184444.8Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nCVE-2026-1184456.9A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are expoCVE-2026-1184466.9A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrayCVE-2026-1184474.8A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. TCVE-2026-1184486.9A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, i
CVE-2026-118423: Critical severity, CVSS 10.0 | Vulnix