Unknown WP Libre Form, CVE-2026-118423: a new CVE scored 10

The bottom line

Anyone running WP Libre Form 1.5.0.1 on a WordPress site must act now — the record names no fixed version. Disable or remove the plugin immediately while you wait for a patch from the author.

Free analysis report · 9 pagesUnknown WP Libre Form, CVE-2026-118423: a new CVE scored 10The same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

An unauthenticated attacker — no account required — can upload a PHP file through the plugin's form submission feature and then run it on the server, giving them full remote code execution.

Why it matters

The CVE score is 10 — the maximum on CVSS 3.1. The description says no login is needed: any visitor can attempt to upload a PHP file and run it. The weakness is CWE-434 (unrestricted upload of a dangerous file type). Our reading is that this combination — maximum score, no authentication barrier, and direct code execution — makes this worth acting on immediately even though the record is new and no vendor advisory could be read. No workaround beyond disabling the plugin is currently known.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• There must be a patched version — I just need to update. The record lists no unaffected releases and no vendor advisory could be read. No fixed version is currently known; do not assume a version bump addresses this flaw without a changelog entry that names it.
• Because it is not on CISA's exploited list, this can wait. The CVE score is 10 and the description says no authentication is needed. A new record's absence from CISA's list reflects when it was read, not the severity of the flaw.

How we would triage it

This is our judgement.

Step 1: Find whether WP Libre Form is installed and note the version

• In WordPress admin, go to Plugins and look for 'WP Libre Form'; note the version shown beside it.
• If WP-CLI is available, the command below prints the installed version and status.

Step 2: Disable or remove the plugin if version 1.5.0.1 is found

• The record names no fixed version; disabling the plugin removes the file upload route while you wait for a patch.
• Deleting the plugin entirely is the safer option if no site function depends on it.

Step 3: Check whether a fixed release has appeared

• No unaffected release is listed in the record; check the plugin's changelog for any entry that names CVE-2026-118423 or a file upload security fix.
• Do not reinstall based on a version bump alone unless the changelog confirms it covers this CVE.

Step 4: Confirm the site operates correctly without the plugin and record what was done

• Identify any forms relying on WP Libre Form and arrange alternatives if needed.
• Keep a written record of when the plugin was disabled, the version found, and who took the action.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

We have been made aware of a security flaw in the WP Libre Form WordPress plugin (CVE-2026-118423, CVSS score 10). The record states that an unauthenticated attacker can upload a PHP file through the plugin's form and execute it on the server. The only version named in the record is 1.5.0.1. No fixed version is currently recorded and no vendor advisory could be read. Please check whether this plugin is installed on any WordPress site we operate, confirm the installed version, and advise what action to take. If version 1.5.0.1 is present, we would like written confirmation that the plugin has been disabled or removed, together with the version confirmed, by 13 November 2026.

The weakness behind it

The record classes this as CWE-434.

The sources, in their words

The CVE record:

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Versions of Unknown WP Libre Form the record lists as affected:

• 1.5.0.1 through 1.5.0.1

The record gives no version ranges. Use the vendor's advisory for the affected versions.

Check your own project

If you build software, you can compare what a project declares with this CVE from a terminal. The tool reads requirements files, package.json, Maven, Gradle, Cargo, CMake and Dockerfile files, runs nothing, and only the CVE id leaves your machine. Naming the CVEs needs no key.

lattice-scan project . --cve CVE-2026-118423

Each row says in-range, outside-range, undetermined or lead, with the file and line. That is evidence about what a manifest declares, not about what runs, and a person decides. The verdicts, the CSV columns and a pipeline recipe are in the guide.

Check the servers you run

The same id can be checked against a host. Run this on the machine itself, not on the laptop that deploys to it: it reads installed packages (dpkg, rpm or apk), snaps, the names of running container images and the kernel version, compares them on the spot, and only the CVE ids leave the machine; the inventory stays on it, in ~/.lattice-scan. Naming the CVEs needs no key. Do it on each server after a deployment, and again when a new entry lands.

lattice-scan --cve CVE-2026-118423

A match is a candidate for a person to confirm, not a finding. A distribution can fix a CVE under an unchanged version number, so a match is a candidate; on Debian-family hosts the report also shows whether the package's own changelog names the CVE. It reads the names of the running images, not what is inside them; for what an image declares, use the project check on its Dockerfile.

Guide: namiq.io/lattice/guides/choose-your-channel. MCP server (io.namiq/lattice in the MCP registry): namiq.io/lattice. Package: pypi.org/project/lattice-scan, or namiq.io/apt.

• Which way into Lattice fits your job →The command line, the Claude skill or the MCP server: what each needs, what works without a key and how to read the result.
• Lattice, the MCP server →The public graph the command reads, for AI agents over MCP.
• Install and connect →The signed apt repository, the fingerprint, and the connection commands for each client.

What we do not know yet

• Whether a fixed version exists or is planned; no vendor advisory could be read and the record lists no unaffected releases.
• Whether versions other than 1.5.0.1 are affected; the record names only that exact version.
• Whether any workaround short of disabling the plugin is available.
• Whether the plugin is still actively maintained by its author.
• Exploitation is not recorded. That is not the same as none.
• This is a new record: scores, versions and wording can change in the first days, and they are as at 6 November 2026. We have not read the vendor's advisory page and we have not tested it.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• The day's CVE highlight →The three new records we picked that day, and how we chose them.
• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.