CVE-2026-118235 in SimpleForm Plugin
Summary
by MITRE • 10/31/2026
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The SimpleForm plugin for WordPress, specifically versions up to and including 3.10.2, contains a critical security vulnerability that allows arbitrary file uploads leading to remote code execution. This flaw resides within the handle_upload function, which is responsible for processing files submitted through forms embedded in websites using this plugin. The core issue stems from insufficient server-side validation of uploaded file extensions and MIME types. Specifically, the application fails to implement an allowlist approach for validating file keys before sanitization occurs during extension derivation. This architectural weakness enables attackers to bypass standard security checks by exploiting how filenames are processed on the backend.
The technical mechanism behind this vulnerability involves the handling of trailing dots in filename strings. When a user uploads a file with a name ending in a dot, such as shell.php., the server-side logic derives the extension incorrectly or fails to strip the trailing character before validation. In many web server configurations and PHP environments, files named with a trailing dot may be treated differently than their base counterparts during execution or storage. By appending a period to an executable file extension like php, asp, or jsp, attackers can trick the application into accepting what it should reject as invalid due to non-standard extensions. This bypasses both MIME type checks and extension allowlists because the validation logic does not account for this edge case in filename parsing.
The impact of this vulnerability is severe, granting unauthenticated remote code execution capabilities to any visitor with access to a page containing an embedded SimpleForm shortcode. Since the only access control mechanism implemented is a nonce value stored within the data-nonce attribute of each public form's HTML structure, obtaining this token requires no authentication or special privileges. Any user visiting the webpage can inspect the source code and extract the nonce easily. With both the valid nonce and the ability to craft malicious file uploads using trailing-dot techniques, an attacker can upload web shells or other executable scripts directly onto the server hosting the WordPress installation.
This scenario aligns with CWE-434, which describes the issue of uploading arbitrary files that may be dangerous if executed by a web application. Furthermore, it maps to MITRE ATT&CK technique T1505.003, known as Web Shell: ASPX, or more broadly T1505 Server Software Component when considering PHP scripts uploaded via WordPress plugins. The lack of proper input validation and the triviality of obtaining required authentication tokens make this a high-severity risk that can lead to complete compromise of the underlying server infrastructure if left unpatched.
Mitigation strategies must focus on immediate patching and enhanced security controls. Administrators should update the SimpleForm plugin to version 3.10.3 or later, where these validation flaws have been addressed by developers implementing stricter file extension checks that account for trailing characters. In addition to updating software, organizations should enforce strict server-side configuration rules such as disabling script execution in upload directories using web server directives like Apache's Options directive or Nginx location blocks. Implementing Content Security Policy headers and monitoring logs for unusual file creation patterns can also help detect attempts at exploitation before they result in successful compromise. Regular audits of third-party plugins against known vulnerability databases are essential to maintaining a secure WordPress environment.