CVE-2026-125055

Name of the Vulnerable Software and Affected Versions Chatterbug Forms – Fast, Flexible WordPress Form Builder versions prior to 1.0.3

Description An arbitrary file upload issue exists due to missing server-side file extension validation within the cbforms check form submissions() function. When no field restriction is configured, the allowed-type check defaults to the extension of the uploaded file, allowing the upload of executable files such as .php. This enables unauthenticated attackers to achieve remote code execution. The submission nonce used for validation is printed inline on public pages, making it easily obtainable by unauthenticated visitors.

Recommendations Update Chatterbug Forms – Fast, Flexible WordPress Form Builder to version 1.0.3 or later. As a temporary workaround, restrict the use of the cbforms check form submissions() function until the update is applied.