CVE-2026-118423

{
  "etk_id": "ETK-2026-3702",
  "cve_id": "CVE-2026-118423",
  "display_id": "CVE-2026-118423",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-117971",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated unrestricted file upload in WP Libre Form",
  "summary": "WP Libre Form 1.5.0.1 does not properly restrict file types submitted through its forms. An unauthenticated attacker may upload server-executable PHP files to a web-accessible location and run code, provided the plugin's upload form is exposed and uploaded files can be served and executed by the web server.",
  "mitigation": "Disable WP Libre Form upload forms or restrict public access to them until an updated release is available. Configure the web server to prevent execution of PHP and other scripts in upload directories.",
  "vendor": null,
  "product": "WP Libre Form",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.5.0.1, <= 1.5.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "WP Libre Form",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.525117383333333,
  "t0_at": "2026-11-06T07:30:55.270000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-06T07:30:55.270000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T07:30:55.270000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-118423"
    }
  }
}