The Innovative Form Builder Ivyforms
Monthly
Arbitrary file upload in the WordPress plugin The Innovative Form Builder - IvyForms, affecting all versions up to and including 1.5.1, allows a user holding the custom add_edit_forms capability to publish a File Upload field whose allowed-extension list contains a dangerous type such as .php, after which an unauthenticated visitor can push an executable file through the public /wp-json/ivyforms/v1/form/submission/ REST route and achieve remote code execution. Exploitation is therefore two-stage: the first stage requires an account with form-editing rights and a deliberately permissive form configuration, while the second stage - the actual upload - needs no authentication and no user interaction from the victim. The 8.8 CVSS score reflects post-configuration impact rather than immediate exposure, since a site whose forms only allow benign extensions is not exploitable; no public exploit code was identified at the time of analysis and the plugin is not listed in CISA KEV, with priority assessed as this_week.
Arbitrary file upload in the WordPress plugin The Innovative Form Builder - IvyForms, affecting all versions up to and including 1.5.1, allows a user holding the custom add_edit_forms capability to publish a File Upload field whose allowed-extension list contains a dangerous type such as .php, after which an unauthenticated visitor can push an executable file through the public /wp-json/ivyforms/v1/form/submission/ REST route and achieve remote code execution. Exploitation is therefore two-stage: the first stage requires an account with form-editing rights and a deliberately permissive form configuration, while the second stage - the actual upload - needs no authentication and no user interaction from the victim. The 8.8 CVSS score reflects post-configuration impact rather than immediate exposure, since a site whose forms only allow benign extensions is not exploitable; no public exploit code was identified at the time of analysis and the plugin is not listed in CISA KEV, with priority assessed as this_week.