CVE-2026-118423

CRITICAL10.0

Published 2026-11-06 · Source contact@wpscan.com

Description

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/35149a79-aee1-4f13-ba29-583c2224c5da/

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-123294
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow
2026-11-06 · score 9.6
CVE-2026-123279
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
2026-11-06 · score 9.0
CVE-2026-88800
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
2026-11-06 · score 9.1
CVE-2026-120844
Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.
2026-11-06 · score 9.8
CVE-2026-119516
Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.
2026-11-06 · score 9.8