CVE-2026-118423 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-118423 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-118423 is a critical remote code execution flaw in the WP Libre Form WordPress plugin 1.5.0.1. The plugin does not validate uploaded file types in form submissions, allowing an unauthenticated attacker to upload a PHP file into a web-accessible location and execute it on the server. That means a single malicious form submission can lead to full site compromise.

This is especially dangerous for solo developers and small teams because WordPress sites often run with broad file permissions, shared hosting defaults, and limited monitoring. Even though there is currently no known exploitation in the wild and it is not in CISA KEV, the severity is CRITICAL (CVSS 10), so treat this as an emergency.

Immediate Action

  • Disable or remove WP Libre Form immediately if you do not need it right now. If the plugin is business-critical, isolate the site or disable form submission features until patched.
  • Upgrade to the first fixed version as soon as the vendor releases it. If no fix is available yet, TODO: apply vendor hotfix / temporary mitigation and monitor the vendor advisory page: vendor advisory.
  • Block PHP execution in upload directories at the web server level to reduce the chance of code execution from a malicious upload.
  • Review recent uploads and web logs for suspicious filenames such as .php, .phtml, or double extensions like .jpg.php.
  • Rotate credentials if you find any sign of compromise: WordPress admin passwords, database credentials, API keys, and hosting panel access.
  • Take a backup before cleanup, but do not restore from a backup that may already contain the malicious file.

Affected Versions

  • WP Libre Form 1.5.0.1 — vulnerable
  • WP Libre Form <= 1.5.0.1 — vulnerable unless the vendor states otherwise
  • WP Libre Form >= TODO_FIXED_VERSION — safe, once the vendor confirms the fix

Note: If the fixed version is not yet published, treat all currently deployed versions as unsafe and use the mitigations below.

Resolution Guide

WordPress plugin update/removal:

# If managed through WP-CLI
wp plugin deactivate wp-libre-form
wp plugin delete wp-libre-form

# Reinstall only after a fixed release is available
wp plugin install wp-libre-form --force

Manual hardening to stop PHP execution in uploads:

# Apache: place in wp-content/uploads/.htaccess
<FilesMatch "\.php$">
  Require all denied
</FilesMatch>

# Nginx: block PHP in uploads
location ~* ^/wp-content/uploads/.*\.php$ {
  deny all;
  return 403;
}

Docker / containerized WordPress:

# Prefer a patched image tag when available
docker pull wordpress:TODO_PATCHED_TAG

# Temporary mitigation: mount uploads read-only if your workflow allows it
docker run -v wp_uploads:/var/www/html/wp-content/uploads:ro ...

Linux package hygiene:

# Debian/Ubuntu host hardening for web server config reload
sudo apt update
sudo apt install --only-upgrade apache2 nginx php-fpm

# RHEL/CentOS/Fedora
sudo yum update

JavaScript/Python/Java ecosystems: This issue is plugin-specific to WordPress, so there is no direct npm, pip, or Maven dependency to upgrade unless your deployment wraps WordPress in tooling. If you vendor or package the site, update the plugin artifact in your release pipeline and redeploy the site image.

Minimal code-level mitigation idea: if you maintain a fork or custom patch, reject executable extensions before saving uploads.

<?php
$allowed = ['jpg', 'jpeg', 'png', 'gif', 'pdf'];
$ext = strtolower(pathinfo($_FILES['upload']['name'], PATHINFO_EXTENSION));

if (!in_array($ext, $allowed, true)) {
    wp_die('File type not allowed');
}

Detection & Verification

Check version:

# From the WordPress admin UI:
# Plugins > Installed Plugins > WP Libre Form

# From the filesystem:
grep -R "Version:" wp-content/plugins/wp-libre-form/*.php

Search for suspicious files:

find wp-content/uploads -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.php5" -o -name "*.php7" \) -ls
find wp-content/uploads -type f | grep -Ei '\.(jpg|png|gif|pdf)\.php$|\.php\.'

Review web server logs for upload-and-execute patterns:

# Apache
grep -Ei "wp-content/uploads|\.php" /var/log/apache2/access.log

# Nginx
grep -Ei "wp-content/uploads|\.php" /var/log/nginx/access.log

Verify the fix:

# Confirm the plugin is removed or updated
wp plugin list | grep -i "wp-libre-form"

# Confirm PHP cannot execute from uploads
curl -i https://example.com/wp-content/uploads/test.php
# Expected: 403 Forbidden or 404 Not Found, not 200 OK

# Confirm only safe file types are accepted through the form
# Submit a test .php file and ensure it is rejected server-side

Risk and Impact

If exploited, this vulnerability can give an attacker remote code execution on your WordPress server with no login required. That can lead to defacement, malware installation, credential theft, spam injection, data exfiltration, and pivoting into the rest of your hosting environment.

For small teams, the blast radius can be wider than the site itself: shared hosting accounts, connected databases, object storage credentials, email systems, and CI/CD secrets may all be exposed if the attacker gains shell-level control. Treat this as a same-day remediation item.

Keep reading