CVE-2026-118423

Name of the Vulnerable Software and Affected Versions WP Libre Form version 1.5.0.1

Description An unauthenticated file upload weakness exists because the plugin fails to validate the type of files uploaded through form submissions. This allows attackers to upload PHP files to a web-accessible location and execute them, resulting in remote code execution (RCE), which is the ability to run arbitrary commands on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.