CVE-2026-10818

HIGH

WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-10818. PoCs published by Nxploited.

AI-analyzed exploit summary This PoC exploits CVE-2026-10818, an unauthenticated arbitrary file write vulnerability in WPForms Pro <= 1.10.1.1. The exploit leverages a flaw in the chunked upload lifecycle where file validation occurs after file assembly, allowing attackers to upload executable PHP files via predictable paths derived from client-controlled UUIDs.

Description

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Exploits (1)

github WORKING POC
by Nxploited · pythonpoc
https://github.com/Nxploited/CVE-2026-10818

This PoC exploits CVE-2026-10818, an unauthenticated arbitrary file write vulnerability in WPForms Pro <= 1.10.1.1. The exploit leverages a flaw in the chunked upload lifecycle where file validation occurs after file assembly, allowing attackers to upload executable PHP files via predictable paths derived from client-controlled UUIDs.

Classification
Working Poc 98%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: WPForms Pro (WordPress plugin) versions up to and including 1.10.1.1
No auth needed
Prerequisites: Target must have WPForms Pro plugin installed (version <= 1.10.1.1) · AJAX endpoints (`wpforms_upload_chunk_init`, `wpforms_upload_chunk`, `wpforms_file_chunks_uploaded`) must be accessible · PHP execution must be enabled on the server
mistral-large-3 · analyzed Jul 26, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 8.1
EPSS 0.0042
EPSS Percentile 34.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
WPForms/WPForms Pro < 1.10.1.1
Published Jul 25, 2026
Tracked Since Jul 25, 2026