SimpleForm CVE-2026-118235

No special conditions beyond the plugin being installed and at least one public page embedding the SimpleForm form shortcode (which exposes the data-nonce value that gates handle_upload). The exploit requires sending a file with a trailing-dot filename to the handle_upload function, which lacks a server-side file key allowlist and derives the extension before sanitization, bypassing all extension and MIME checks. The practical limiting factors are: the plugin (versions up to and including 3.10.2) must be installed and active, and a form must be embedded somewhere publicly reachable so the nonce is obtainable; successful RCE additionally requires that the upload destination permits execution of the uploaded file type by the web server. No authentication, no privileged account, and no user interaction are required.

This is a genuine top-priority vulnerability, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes fully remote, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact, and the description substantiates each of those metrics: the only access control is a nonce that the plugin itself prints into every public form's data-nonce attribute, so the PR:N (unauthenticated) metric is not merely formal - the nonce is trivially harvestable by any visitor, meaning there is effectively no authentication barrier. The CWE-434 arbitrary file upload leading to RCE matches the C:H/I:H/A:H impact. The vuln.today decision label is act_now, and the finding was reported by Wordfence, a credible WordPress-vulnerability source. The main caveat is that no EPSS score and no KEV listing were provided in the input, and no confirmed working exploit code is referenced; therefore active, widespread exploitation is NOT demonstrated by the available data. In short: this is a real, high-urgency issue driven by an unauthenticated-RCE mechanism and an act_now decision label, not a high-CVSS-but-low-real-risk case - but the urgency rests on the severity and ease of exploitation, not on evidence of in-the-wild attacks, which the input does not establish.

An unauthenticated attacker visits any public page that embeds the SimpleForm shortcode, reads the nonce from the form's data-nonce attribute, and submits the handle_upload endpoint a malicious file whose name ends in a trailing dot (e.g. shell.php.), which bypasses the extension and MIME validation. The uploaded executable file is then requested directly to achieve remote code execution. No public exploit code is identified in the provided data, though the vulnerable source lines are publicly browsable on the WordPress plugin trac.