What is CVE-2026-118423?

CVE-2026-118423 is a critical-severity vulnerability in Wp Libre Form, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 10.0/10. Published 2026-11-06.

How severe is CVE-2026-118423?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Arbitrary file upload in Wp Libre Form

CVE-2026-118423

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Vulnerability class: Unrestricted File Upload

Published 2026-11-06 · last modified 2026-11-06.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Wp Libre Form

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

wpscan.com/vulnerability/35149a79-aee1-4f13-ba29-583c2224c5da/ (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-118423?: CVE-2026-118423 is a critical-severity vulnerability in Wp Libre Form, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 10.0/10. Published 2026-11-06.
How severe is CVE-2026-118423?: Critical severity. CVSS v3 base score is 10.0 out of 10.