CVE-2026-9815

The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.21% chance of exploitation in the next 30 days, 12th percentile

Published

2026-06-18

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/043f449f-fc65-4218-83d2-7742e62f2af3/

References

• CVE Record
• NVD entry

Related

• CVE-2026-9811
• CVE-2026-9822
• CVE-2026-9810
• CVE-2026-9830
• CVE-2026-9809
• CVE-2026-9833