CVE-2026-10818: WPForms Pro WordPress Plugin RCE Vulnerability

CVE-2026-10818 Overview

The WPForms Pro plugin for WordPress contains an arbitrary file upload vulnerability affecting all versions up to and including 1.10.1.1. The flaw resides in the ajax_chunk_upload_finalize function, where file type validation occurs after chunk metadata and file contents have already been written to disk. When validation fails, the assembled file is not deleted, leaving executable content on the server. Unauthenticated attackers can upload files that may lead to remote code execution on affected WordPress sites. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Unauthenticated attackers can upload executable files to WordPress servers running vulnerable WPForms Pro versions, enabling remote code execution and full site compromise.

Affected Products

WPForms Pro plugin for WordPress, versions up to and including 1.10.1.1
WordPress installations using the vulnerable WPForms Pro plugin
Sites exposing the ajax_chunk_upload_finalize endpoint to unauthenticated users

Discovery Timeline

2026-07-25 - CVE-2026-10818 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-10818

Vulnerability Analysis

The vulnerability affects the chunked file upload mechanism used by WPForms Pro to handle large file uploads. The plugin implements chunked uploads by receiving file segments through AJAX requests and assembling them on the server. The ajax_chunk_upload_finalize function is responsible for combining these chunks into the final file.

The root problem is the sequence of operations. The function writes chunk metadata and file contents to disk before performing file type validation. When validation subsequently determines that the file type is disallowed, the plugin fails to remove the already-assembled file from the server. This leaves attacker-controlled content accessible on the filesystem.

The endpoint requires no authentication, expanding the attack surface to any remote user who can reach the WordPress site. Successful exploitation of a PHP or otherwise executable payload results in remote code execution under the web server's privileges.

Root Cause

The root cause is a time-of-check to time-of-use flaw in the upload finalization logic. Validation is performed after disk writes rather than before, and cleanup routines do not execute on validation failure. This violates secure file upload principles, which require validating file type, extension, and content before persisting data to disk.

Attack Vector

An unauthenticated attacker sends crafted chunked upload requests to the WPForms ajax_chunk_upload_finalize endpoint. The attacker submits a file with a disallowed extension such as .php. The plugin assembles the chunks and writes the complete file to the uploads directory. Validation fails but the file remains on disk. The attacker then requests the uploaded file via HTTP to trigger execution by the PHP interpreter.

No verified proof-of-concept code is publicly available at this time. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-10818

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) in the WordPress wp-content/uploads/wpforms/ directory or temporary chunk directories
HTTP POST requests targeting admin-ajax.php with the wpforms_upload_chunk or wpforms_upload_chunk_init actions from unauthenticated sources
Web server access logs showing subsequent GET requests to newly created files in upload directories
Outbound network connections initiated from the web server process to unfamiliar hosts following upload activity

Detection Strategies

Monitor WordPress upload directories for files with executable extensions and file signatures that do not match the declared type
Inspect web server logs for anomalous AJAX request patterns targeting WPForms chunk upload actions
Correlate file creation events in upload paths with subsequent script execution or process spawns from the web server user

Monitoring Recommendations

Enable file integrity monitoring on WordPress installation and upload directories
Log and review all AJAX endpoint calls associated with the WPForms plugin
Alert on any PHP process execution originating from within wp-content/uploads paths
Track outbound connections from PHP-FPM or the web server to detect post-exploitation command and control

How to Mitigate CVE-2026-10818

Immediate Actions Required

Update WPForms Pro to a version later than 1.10.1.1 as soon as the vendor releases a patched build
Audit the wp-content/uploads/wpforms/ directory for unauthorized files and remove any that do not match expected form submission content
Restrict PHP execution within WordPress upload directories using web server configuration
Review WordPress user accounts and web shell indicators for signs of prior exploitation

Patch Information

Refer to the WPForms official site for the latest plugin release and security advisories. The Wordfence Vulnerability Report tracks the patched version once available. Apply the update across all WordPress sites running WPForms Pro.

Workarounds

Deploy a web application firewall rule to block unauthenticated requests to WPForms chunk upload AJAX actions
Disable the WPForms Pro plugin until a fixed version is installed if the plugin is not business-critical
Configure the web server to deny execution of PHP files inside wp-content/uploads/ using directives such as Apache <FilesMatch> or Nginx location blocks

bash

# Nginx configuration to prevent PHP execution in WordPress uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}

# Apache equivalent for .htaccess in wp-content/uploads/
# <FilesMatch "\.(php|phtml|phar|php[0-9])$">
#     Require all denied
# </FilesMatch>