CVE-2026-118423: critical vulnerability in WP Libre Form
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
70Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 10epss 0.6%
from disclosure to weaponsame day
Published on NVDNov 6
1st PoCNov 6
VulnCheckNov 6
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Unknown · WP Libre Formpublic PoCs found — 6
githubgithub.com/thiscitze/cve-2026-118423-poc★ 0githubgithub.com/im0xfay/CVE-2026-118423★ 0githubgithub.com/Sable-Research/CVE-2026-118423-WP-Libre-Form★ 0cve_referencewpscan.com/vulnerability/35149a79-aee1-4f13-ba29-583c2224c5da/unverifiedvulncheckvulncheck.com/xdb/170aa48de710unverifiedvulncheckvulncheck.com/xdb/d47fe87c7745unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.