CVE-2026-10818

Name of the Vulnerable Software and Affected Versions WPForms Pro versions prior to 1.10.1.2

Description An arbitrary file upload issue exists in the ajax chunk upload finalize() function. The flaw occurs because file type validation is performed after the chunk metadata and file contents are written to the disk, and the assembled file is not deleted if validation fails. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution.

Recommendations Update WPForms Pro to version 1.10.1.2 or later. As a temporary mitigation, restrict access to the ajax chunk upload finalize() function.