CVE-2026-10818: WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wpforms-proto a version that resolves this vulnerability.Fixed in 1.10.1.1 - Compensating control
Block or restrict access to the unauthenticated chunked upload endpoints used by WPForms Pro (ajax_chunk_upload_finalize and the related chunk upload workflow) until the plugin is updated.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10818?
The severity of CVE-2026-10818 is rated high with a CVSS score of 8.1.
How do I fix CVE-2026-10818?
To fix CVE-2026-10818, update WPForms Pro to version 1.10.1.2 or later.
What type of vulnerability is CVE-2026-10818?
CVE-2026-10818 is an unauthenticated arbitrary file upload vulnerability.
What software is affected by CVE-2026-10818?
The affected software is WPForms Pro, specifically versions up to and including 1.10.1.1.
What causes the vulnerability in CVE-2026-10818?
The vulnerability is caused by improper validation of file types after the file contents have been uploaded.