SECURITYHIGHCVE-2026-10818

CVE-2026-10818: WPForms Pro Arbitrary File Upload — Unauthenticated RCE

A high-severity vulnerability in WPForms Pro allows unauthenticated attackers to upload malicious files and achieve remote code execution. File type...

Dylan H.

Security Team

July 25, 2026
3 min read
CVE-2026-10818: WPForms Pro Arbitrary File Upload — Unauthenticated RCE

Affected Products

  • WPForms Pro ≤ 1.10.1.1

Overview

A high-severity arbitrary file upload vulnerability has been disclosed in WPForms Pro, one of the most widely deployed contact form plugins for WordPress. All versions up to and including 1.10.1.1 are vulnerable. An unauthenticated remote attacker can upload a PHP web shell or other executable file, and subsequently execute it on the server — leading to full Remote Code Execution (RCE).

The flaw is tracked as CVE-2026-10818 with a CVSS v3.1 score of 8.1 (High).

Technical Details

The vulnerability resides in the ajax_chunk_upload_finalize function, which handles the reassembly of chunked file uploads submitted via wp-admin/admin-ajax.php. The critical design flaw is a time-of-write / time-of-check ordering failure — the file is assembled and written to disk before the file type validation runs:

  1. An attacker submits a malicious file (e.g., a PHP web shell) split into upload chunks
  2. The ajax_chunk_upload_finalize function assembles the chunks and writes the complete file to disk
  3. File type validation is then performed — and the upload is rejected
  4. However, the assembled file is not deleted from disk
  5. The attacker knows (or can predict) the file path and executes the file directly

This is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
MetricValueNotes
Attack VectorNetworkRemotely exploitable
Attack ComplexityHighAttacker must locate and execute the file
Privileges RequiredNoneNo authentication needed
User InteractionNoneFully automated exploitation possible
ConfidentialityHighFull data access if exploited
IntegrityHighFull system write access
AvailabilityHighServer can be taken offline

Affected Systems

Any WordPress installation running WPForms Pro version 1.10.1.1 or earlier with file upload form fields exposed to unauthenticated users is potentially vulnerable.

WPForms is one of the most popular WordPress plugins globally, making this a high-exposure finding. The attack surface includes any form with file upload capability that does not require a logged-in user.

Indicators of Compromise

If you suspect exploitation, look for the following:

  • Unexpected PHP files in wp-content/uploads/ or plugin temp directories
  • Suspicious POST requests to /wp-admin/admin-ajax.php with action=wpforms_upload_chunk_finalize
  • New admin accounts or modified WordPress core files
  • Web server processes spawning unexpected child processes

Mitigation

Immediate Actions

  1. Update WPForms Pro to a version beyond 1.10.1.1 — check the official WPForms changelog for the patched release.
  2. Audit the uploads directory — search for .php, .phtml, .phar, and similar executable files in wp-content/uploads/ that should not be present.
  3. Deploy or tune a WAF to block suspicious POST requests to admin-ajax.php with chunked upload parameters.

Additional Hardening

  • Restrict file upload forms to authenticated users where possible
  • Configure your web server to deny execution of scripts in upload directories (php_flag engine off in .htaccess)
  • Enable file integrity monitoring on critical WordPress directories

References