Description

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-11-06T08:17:18.550Z",
  "pubdate": "2026-11-06T08:17:18.550Z",
  "executiveSummary": "The WP Libre Form WordPress plugin version 1.5.0.1 is vulnerable to an arbitrary file upload flaw that permits unauthenticated remote code execution (RCE).\nThe vulnerability originates from a failure to perform server-side validation on file types submitted through the plugin's form submission mechanism.\nBy bypassing client-side restrictions, an attacker can upload malicious PHP scripts directly to a directory accessible via the web server.\nSuccessful exploitation allows an unauthenticated attacker to execute arbitrary code with the privileges of the web server process, potentially leading to full site compromise, data exfiltration, and lateral movement within the hosting environment.\nGiven that the vulnerability does not require prior authentication or elevated privileges, it presents a critical risk to any WordPress installation utilizing the affected version of the plugin.",
  "technicalDetails": "The vulnerability resides within the file handling logic of WP Libre Form 1.5.0.1, specifically concerning the processing of file uploads submitted via forms. The plugin fails to implement robust server-side MIME type or extension verification, allowing users to upload executable files, such as those with a .php extension, to the server's filesystem.\nThe attack vector involves a malicious actor crafting an HTTP POST request containing a multipart/form-data payload. Within this payload, the attacker substitutes a legitimate file upload with a malicious PHP webshell. Because the plugin lacks a whitelist or blacklist mechanism to filter the file extension or validate the content type against the expected file format, the uploaded script is saved to a public-facing directory defined by the plugin's storage configuration.\nOnce the file is uploaded, the attacker performs a direct request to the file's URI. Since the file is stored in a web-accessible path, the web server (e.g., Apache or Nginx) interprets the request as a script execution. This initiates the PHP interpreter to parse and execute the embedded malicious code.\nThe post-exploitation impact is severe, granting the attacker the ability to interact with the underlying operating system as the web server user. This includes, but is not limited to, accessing sensitive configuration files (e.g., wp-config.php), modifying the database, installing persistent backdoors, or utilizing the server as a pivot point for internal network scanning.\nThe flaw is exacerbated by the lack of authentication, meaning any remote actor with network connectivity to the site can trigger the upload. The exploitation process is highly reliable as it relies on fundamental web application misconfiguration—specifically the absence of file validation—which allows an attacker to bypass simple front-end constraints entirely."
}