CVE-2026-118423

CVE-2026-118423 is an unrestricted file upload vulnerability affecting the WP Libre Form WordPress plugin in version 1.5.0.1 and earlier. The issue resides in the plugin's public form submission handler, which registers the AJAX action `wplf_submit` for unauthenticated users. When processing file uploads through these forms, the plugin fails to validate the file types. Although it utilizes the `sanitize_file_name()` function, this does not strip executable extensions like `.php`, allowing arbitrary files to be uploaded. Because the uploaded files are stored in a web-accessible directory, such as `wp-content/uploads/`, unauthenticated remote attackers can directly access and execute them. This allows attackers to run arbitrary PHP code on the server, potentially compromising the WordPress installation and pivoting to the underlying host. To mitigate this vulnerability, users are advised to update the plugin to a patched version, deactivate the plugin, or restrict PHP script execution within the WordPress uploads directory.