Summary
CVE-2026-10818 is a high-severity arbitrary file upload vulnerability (CWE-434) in WPForms Pro, a WordPress form-builder plugin active on over 6 million websites. The flaw affects all versions up to and including 1.10.1.1 and allows unauthenticated remote attackers to upload executable files to the server, leading to Remote Code Execution (RCE). The CVE carries a CVSS v3.1 score of 8.1 (HIGH).
Technical details
- Root cause: The
ajax_chunk_upload_finalizefunction performs file type validation only after chunk metadata and the assembled file contents have already been written to disk. When validation subsequently fails, the assembled file is not deleted, leaving the malicious file persisted on the server’s filesystem. - Trigger conditions: The attack targets WordPress sites running WPForms Pro with file upload fields active in published forms. The CVSS Attack Complexity is rated High (AC:H), which reflects the specific conditions required (e.g., presence of a file upload field on an exposed form).
- Attack vector: Fully network-accessible (AV:N), requiring no authentication (PR:N) and no user interaction (UI:N). An attacker sends crafted chunked upload requests to the AJAX endpoint directly, with no prior login needed.
- Impact: Successful exploitation results in an attacker-controlled executable file residing on the web server. If the web server processes or executes the file (e.g., via a web shell), the attacker achieves Remote Code Execution, leading to full compromise of confidentiality, integrity, and availability of the affected system.
Affected software
- WPForms Pro – all versions up to and including 1.10.1.1
Severity
- CVSS v3.1 Base Score: 8.1 (HIGH)
- Vector String:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-434 – Unrestricted Upload of File with Dangerous Type
Mitigation and recommended actions
- Immediate: Update WPForms Pro to the latest available version beyond 1.10.1.1. Monitor the official WPForms changelog for a security release addressing this CVE.
- Interim workaround: If immediate patching is not possible, disable or remove any file upload fields from publicly accessible WPForms forms to eliminate the exposed attack surface.
- Network mitigation: Restrict access to the WPForms AJAX upload endpoint (
wp-admin/admin-ajax.phpwith WPForms upload actions) via WAF rules or network controls where operationally feasible.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

