Critical severity10.0NVD Advisory· Published Nov 6, 2026

CVE-2026-118423

Description

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/WP Libre Form 2llm-fuzzy
Range: <=1.5.0.1

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/35149a79-aee1-4f13-ba29-583c2224c5da/nvd

News mentions

No linked articles in our index yet.

cvss	0.650
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000