MagicForm EUVD-2026-37852

Exploitation requires that the targeted WordPress site has the MagicForm plugin installed in version 0.1.3 or earlier AND that at least one form has a file upload field whose per-field extension allowlist has been left empty (not explicitly populated with allowed extensions). The phrasing 'left empty' strongly implies this is the default state for newly created upload fields, meaning no deliberate misconfiguration by the site administrator is necessary - the plugin's default behavior is the vulnerable state. No authentication is required; the AJAX upload action is explicitly unauthenticated. No user interaction is needed. Exploitation is limited to WordPress sites running this specific plugin; the attack does not generalize to other WordPress plugins or core. The web server must permit PHP execution in the upload destination directory for the payload to run - sites with hardened upload directories blocking PHP execution would prevent the final code-execution step but not the file write itself.

The vendor-assigned CVSS score of 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N is a significant underestimate of real-world impact. The impact metrics C:L/I:L/A:N are inconsistent with a vulnerability that grants arbitrary PHP code execution on the server - a condition that typically yields full confidentiality, integrity, and availability compromise, and likely extends beyond the vulnerable component itself (Scope:Changed). EPSS at 0.18% (7th percentile) suggests low observed exploitation probability at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed mass exploitation. However, a publicly available proof-of-concept exploit (via WPScan) lowers the barrier to exploitation significantly and is a concrete risk amplifier independent of EPSS. The attack complexity is low, requiring no authentication and no user interaction. The principal limiting factor is the condition that the form's per-field extension allowlist must be empty - if this is the default state upon plugin installation (which the phrasing 'left empty' implies), the exploitable population is the entire installed base. Defenders should treat the actual severity as critical, not medium, and should not rely solely on the vendor CVSS score when prioritizing remediation.

An unauthenticated attacker enumerates a target WordPress site as running MagicForm (e.g., via plugin fingerprinting) and identifies a publicly accessible form with no per-field extension restriction. The attacker crafts a multipart/form-data POST request to the WordPress AJAX endpoint (admin-ajax.php) uploading a PHP webshell; because the allowlist is empty, the server accepts and stores the file in a web-accessible upload directory. The attacker then directly requests the uploaded file via HTTP, triggering server-side PHP execution and gaining an interactive shell under the web server's process identity. A public proof-of-concept for this technique is available via WPScan.