Overview
A high-severity arbitrary file upload vulnerability has been disclosed in WPForms Pro, one of the most widely deployed contact form plugins for WordPress. All versions up to and including 1.10.1.1 are vulnerable. An unauthenticated remote attacker can upload a PHP web shell or other executable file, and subsequently execute it on the server — leading to full Remote Code Execution (RCE).
The flaw is tracked as CVE-2026-10818 with a CVSS v3.1 score of 8.1 (High).
Technical Details
The vulnerability resides in the ajax_chunk_upload_finalize function, which handles the reassembly of chunked file uploads submitted via wp-admin/admin-ajax.php. The critical design flaw is a time-of-write / time-of-check ordering failure — the file is assembled and written to disk before the file type validation runs:
- An attacker submits a malicious file (e.g., a PHP web shell) split into upload chunks
- The
ajax_chunk_upload_finalizefunction assembles the chunks and writes the complete file to disk - File type validation is then performed — and the upload is rejected
- However, the assembled file is not deleted from disk
- The attacker knows (or can predict) the file path and executes the file directly
This is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
| Metric | Value | Notes |
|---|---|---|
| Attack Vector | Network | Remotely exploitable |
| Attack Complexity | High | Attacker must locate and execute the file |
| Privileges Required | None | No authentication needed |
| User Interaction | None | Fully automated exploitation possible |
| Confidentiality | High | Full data access if exploited |
| Integrity | High | Full system write access |
| Availability | High | Server can be taken offline |
Affected Systems
Any WordPress installation running WPForms Pro version 1.10.1.1 or earlier with file upload form fields exposed to unauthenticated users is potentially vulnerable.
WPForms is one of the most popular WordPress plugins globally, making this a high-exposure finding. The attack surface includes any form with file upload capability that does not require a logged-in user.
Indicators of Compromise
If you suspect exploitation, look for the following:
- Unexpected PHP files in
wp-content/uploads/or plugin temp directories - Suspicious POST requests to
/wp-admin/admin-ajax.phpwithaction=wpforms_upload_chunk_finalize - New admin accounts or modified WordPress core files
- Web server processes spawning unexpected child processes
Mitigation
Immediate Actions
- Update WPForms Pro to a version beyond 1.10.1.1 — check the official WPForms changelog for the patched release.
- Audit the uploads directory — search for
.php,.phtml,.phar, and similar executable files inwp-content/uploads/that should not be present. - Deploy or tune a WAF to block suspicious POST requests to
admin-ajax.phpwith chunked upload parameters.
Additional Hardening
- Restrict file upload forms to authenticated users where possible
- Configure your web server to deny execution of scripts in upload directories (
php_flag engine offin.htaccess) - Enable file integrity monitoring on critical WordPress directories