CVE-2026-10818highobserved exploitationCWE-434

CVE-2026-10818: high-severity vulnerability in WPForms Pro

WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering

Published · Updated

Follow this CVE+ Monitor WPForms Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

78Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.1epss 2.5%
from disclosure to weapon1 day
Published on NVDJul 25
1st PoC+1d
VulnCheck+80d
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
WPForms · WPForms Pro
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WPForms Pro

In the same product, most dangerous first.

CVE-2023-7063HIGHCVE-2023-7063EPSS 0.5%CVE-2023-30500MEDIUMWordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-18409HIGHWPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field ValuesEPSS 0.3%