Skip to content
OpenAdvisories
Critical · 10.0 Public exploit CVE-2026-118423 EUVD-2026-117971GHSA-mhrf-qjwq-4j74

WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

Published Nov 6, 2026 · Updated Nov 6, 2026 · Assigned by WPScan

Category: Web / CMS

Description

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Affected products

VendorProductAffectedFixed
— WP Libre Form 1.5.0.1 – ≤ 1.5.0.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

  • im0xfay/CVE-2026-118423 ★ 0 · Nov 6, 2026

    CVE-2026-118423 — WP Libre Form <= 1.5.0.1 unauthenticated file upload to RCE (PoC, lab-verified)

  • thiscitze/cve-2026-118423-poc ★ 0 · Nov 6, 2026

    CVE-2026-118423 - WP Libre Form <= 1.5.0.1 unauthenticated upload to RCE (PoC + exploit by thiscitze)

  • Sable-Research/CVE-2026-118423-WP-Libre-Form ★ 0 · Nov 6, 2026

    Sable Research — Analysis of CVE-2026-118423: Unauthenticated Arbitrary File Upload to RCE in WP Libre Form (≤ 1.5.0.1)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References