{"affected":[{"defaultStatus":"unknown","ecosystem":"https://wordpress.org/plugins","product":"WP Libre Form","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.5.0.1","status":"affected","version":"1.5.0.1","versionType":"semver"}]}],"cveId":"CVE-2026-118423","cwes":["CWE-434"],"description":"The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/35149a79-aee1-4f13-ba29-583c2224c5da/"}],"kev":null,"metrics":[{"score":10,"severity":"critical","source":"CNA: WPScan","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793950255270,"publishedAt":1793950255270,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/35149a79-aee1-4f13-ba29-583c2224c5da/"}],"remediation":[],"revision":"8945f7fe3d3ba5b5a66b4f09292099dd02a1b5b3be850d7c517bdd2c4d87cc0f","sources":[{"modifiedAt":1793950255270,"name":"CNA: WPScan","retrievedAt":1793952519013,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118423"}],"ssvc":null,"status":"published","title":"WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload","updatedAt":1793952519013}