What is the CVSS score of CVE-2026-56058?

CVE-2026-56058 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Quform are affected by CVE-2026-56058?

The Quform WordPress plugin (versions 2.23.0 and earlier) contains a critical vulnerability allowing low-privilege site users to upload and execute arbitrary code, resulting in complete website…

How to fix or mitigate CVE-2026-56058?

Within 24 hours: identify all WordPress instances running Quform ≤2.23.0 and disable the plugin; remove file upload permissions for Subscriber-level user roles. Within 7 days: assess vendor patching timeline or evaluate alternative form plugins with security review; scan systems for web shells and unauthorized access indicators. Within 30 days: deploy patched version when released or complete migration to a secure alternative.

Quform CVE-2026-56058

EUVD-2026-39712 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-26 audit@patchstack.com

GHSA-86wc-v2qw-vmwq

WordPress File Upload Wordpress Plugin

9.9

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Subscriber-level account needed so PR:L; network-reachable upload with no victim interaction (AV:N/UI:N), and RCE crossing the authorization boundary justifies S:C with full C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:00 vuln.today

DescriptionCVE.org

Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.

AnalysisAI

Arbitrary file upload in the Quform WordPress plugin (versions <= 2.23.0) lets authenticated users with only Subscriber-level privileges upload files of attacker-controlled type, enabling web shell deployment and full site takeover. The CVSS:3.1 vector (PR:L, S:C) reflects a low privilege bar combined with a scope change, which drives the 9.9 score. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Quform is a commercial drag-and-drop form builder plugin for WordPress that supports file-upload form fields. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the plugin's upload handling does not adequately validate or restrict the type/extension of submitted files, so an authenticated low-privilege user can place an executable file (e.g. a PHP script) into a web-accessible location served by the PHP interpreter. Because WordPress runs uploaded plugin code in the same execution context as the site, a successful upload of server-side script results in remote code execution within the web server process. No CPE strings were provided in the input; affected scope is defined by the vendor as all Quform releases through 2.23.0.

RemediationAI

Upgrade Quform to a release newer than 2.23.0 once confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/quform/vulnerability/wordpress-quform-plugin-2-23-0-arbitrary-file-upload-vulnerability); the exact patched version was not provided in this data set and must be verified before deployment. Because the attack requires a low-privilege account, an immediate compensating control is to disable open user self-registration (Settings > General > 'Anyone can register' unchecked), which removes the Subscriber-account path for unauthenticated attackers - trade-off: blocks legitimate self-service signups. Additionally, restrict or remove file-upload fields from public Quform forms where not strictly needed, and enforce server-side controls to deny execution of files in the upload directory (e.g. block PHP execution in wp-content/uploads via web-server config), accepting that aggressive upload restrictions may break legitimate attachment workflows. A WAF virtual patch for malicious upload payloads (Patchstack offers one) can provide interim coverage until the plugin is updated.