CVE-2026-9815

MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE

The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.

Affected

MagicForm

CVSS v3.1 CNA

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.35% chance of exploitation in the next 30 days, 27th percentile

Published

2026-06-18

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/043f449f-fc65-4218-83d2-7742e62f2af3/

References

• CVE Record
• NVD entry