Unknown WP Libre Form: remote code execution

Unknown WP Libre Form

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Do this now

No source names a fix yet: limit who can reach Unknown WP Libre Form until one does.

Still cooking for WP Libre Form.

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 14:17 UTC
Identifiers: CVE-2026-118423
CVSS: 10.0
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Unknown WP Libre Form: remote code execution
Severity: critical. Patch status: fix status unknown.
Affected: Unknown WP Libre Form
Ids: CVE-2026-118423

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

## Steps
1. Search the repo, its CI and infra config for Unknown WP Libre Form. If present, report the version in use and whether it's affected.
2. WP Libre Form 1.5.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| WP Libre Form 1.5.x | not named in the CVE record | check the vendor advisory: https://wpscan.com/vulnerability/35149a79-aee1-4f13-ba29-583c2224c5da/ | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-118423") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-118423 https://wpscan.com/vulnerability/35149a79-aee1-4f13-ba29-583c2224c5da/
https://pwned.coffee/i/the-wp-libre-form-wordpress-plugin-1-5-0-1-does-not-vali-cve-2026-118423

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
WP Libre Form <= 1.5.0.1 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 6 Nov
The CVE record names no fix for one line; the vendor’s advisory may: wpscan.com
Score: CVSS 10.0 (critical). CVSS 3.1 10 (CNA WPScan) for CVE-2026-118423
Last checked: 6 Nov 2026, 15:18 UTC

Product	Affected	Fixed in	Source
WP Libre Form	<= 1.5.0.1	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 6 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee