SimpleForm CVE-2026-104748

No special conditions beyond having the plugin installed and active - exploitation works against default configurations because get_form_settings() returns a hard-coded defaults array that unconditionally enables meta writing regardless of form_id, and the registration endpoint is reachable by any unauthenticated visitor. The only procedural prerequisite is obtaining the registration nonce, which the plugin itself publicly emits into the front_end_data JavaScript object on every front-end page via wp_enqueue_scripts, so it is not a meaningful barrier. The practical limiting factors are narrow: the site must run SimpleForm version ≤3.10.0 and the vulnerable front-end registration script must be enqueued; no authentication, user interaction, or non-default setting is required.

All available signals point to a genuine high-priority issue rather than an inflated CVSS score. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, and the description corroborates this precisely: the vulnerable AJAX action is exposed via wp_ajax_nopriv_ (unauthenticated) and the required nonce is publicly emitted into the front_end_data JavaScript object on every front-end page, so the one apparent barrier (a nonce) is trivially obtainable. The technical impact is total - creation of an Administrator account yields full confidentiality, integrity and availability compromise of the site, consistent with C:H/I:H/A:H. No EPSS score, CISA KEV entry, or public POC was supplied in the input, so exploitation-probability and in-the-wild signals cannot be confirmed from this data; the risk rating therefore rests on the vector and the detailed, code-referenced root-cause analysis from Wordfence rather than on observed exploitation. Under an SSVC lens this reads as high technical impact and highly automatable (single crafted request, publicly available nonce), but exploitation status is 'none observed' per the available data. Net: treat as a real, urgent priority for any site running this plugin, while noting that active-exploitation and prevalence-of-attack signals are absent, not negative.

An unauthenticated attacker loads any front-end page of a site running SimpleForm ≤3.10.0, scrapes the registration nonce from the front_end_data JavaScript object, then submits a crafted POST to the simpleform_wp_register AJAX action including standard registration fields plus wp_capabilities[administrator]=1. The plugin writes the attacker-controlled capability to user meta without a capability check, creating a new Administrator account and giving the attacker full control of the site. No public exploit was identified in the provided data, but the attack is straightforward to reproduce from the description.