CVE-2026-104748 Overview
CVE-2026-104748 is an unauthenticated privilege escalation vulnerability in the SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress. All versions up to and including 3.10.0 are affected. The flaw allows unauthenticated attackers to create new Administrator-level WordPress accounts by abusing the wp_ajax_nopriv_simpleform_wp_register AJAX action. The required nonce is publicly emitted in the front_end_data JavaScript object on every front-end page, making exploitation trivial. The weakness is categorized as [CWE-269: Improper Privilege Management].
Critical Impact
Any unauthenticated visitor can register a new Administrator account on vulnerable WordPress sites, resulting in full site takeover.
Affected Products
- SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress
- All versions up to and including 3.10.0
- WordPress sites with the plugin enabled on front-end pages
Discovery Timeline
- 2026-10-14 - CVE-2026-104748 published to the National Vulnerability Database (NVD)
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-104748
Vulnerability Analysis
The vulnerability stems from the plugin's registration integration in app/Integrations/WordPressAuth.php. The AJAX action wp_ajax_nopriv_simpleform_wp_register accepts unauthenticated requests and processes user-supplied registration data. During the flow, save_custom_fields_to_user_meta() iterates over POST parameters and writes them to user meta using an exclusion list that does not include wp_capabilities.
Because wp_capabilities is the WordPress user meta key that controls role assignment, an attacker can inject wp_capabilities[administrator]=1 alongside standard registration fields. The newly created user is persisted with the Administrator role, bypassing all intended registration restrictions.
The exposure is amplified by get_form_settings(), which returns a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied form_id. This means every request path reaches the vulnerable meta-write logic without a legitimate form configuration check.
Root Cause
The root cause is improper privilege management across three cooperating defects: a missing capability check on the public AJAX endpoint, an incomplete deny list in save_custom_fields_to_user_meta() that omits wp_capabilities, and get_form_settings() returning permissive defaults that bypass per-form validation.
Attack Vector
An unauthenticated attacker first loads any front-end page of the target site to extract the nonce exposed through the front_end_data JavaScript object enqueued by wp_enqueue_scripts. The attacker then submits a POST request to the admin-ajax.php endpoint invoking simpleform_wp_register, supplying standard registration fields together with the wp_capabilities[administrator]=1 parameter. The server creates a new user and assigns the Administrator role, granting full control of the WordPress installation.
See the Wordfence Vulnerability Report and the WordPress Change Set 3726513 for the vulnerable and patched code paths.
Detection Methods for CVE-2026-104748
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action=simpleform_wp_register containing a wp_capabilities parameter.
- New WordPress user accounts with the Administrator role created from unexpected IP addresses or without a corresponding administrator-initiated workflow.
- User meta records that include an injected wp_capabilities value written during a front-end registration event.
- Unexpected logins from newly created accounts followed by plugin, theme, or user management activity.
Detection Strategies
- Inspect web server access logs for admin-ajax.php POST requests whose body contains the string wp_capabilities.
- Correlate user_register WordPress audit events with the source IP and user agent of recent simpleform_wp_register AJAX calls.
- Alert on any role elevation to administrator that occurs outside of authenticated admin sessions.
Monitoring Recommendations
- Enable a WordPress audit logging plugin to record user creation, role changes, and plugin configuration changes.
- Monitor the wp_users and wp_usermeta tables for new Administrator entries using scheduled integrity checks.
- Forward web and application logs to a centralized analytics platform to retain evidence of pre-patch exploitation attempts.
How to Mitigate CVE-2026-104748
Immediate Actions Required
- Update the SimpleForm plugin to the version released in WordPress Change Set 3726513, which is any release after 3.10.0.
- Audit all WordPress user accounts and remove unrecognized Administrator-level users.
- Rotate credentials, API keys, and session cookies for all remaining administrators after remediation.
- Reinstall WordPress core, themes, and plugins from trusted sources if evidence of compromise is found.
Patch Information
The vendor addressed the flaw in the commit tracked as WordPress Change Set 3726513. The fix adds proper capability checks and prevents arbitrary user meta keys such as wp_capabilities from being written through the public registration path. Site owners should upgrade to the first plugin release that incorporates this change set.
Workarounds
- Deactivate and remove the SimpleForm plugin until the patched version can be installed.
- Add a Web Application Firewall (WAF) rule to block POST requests to admin-ajax.php where action=simpleform_wp_register and the body contains wp_capabilities.
- Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible, acknowledging this may affect legitimate front-end functionality.
- Disable open user registration under Settings → General until the plugin is updated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.