CVE-2026-109384
Arbitrary file upload to RCE in IvyForms through 1.5.1
- CVSS 3.1
- 8.8 high
- EPSS
- <1%p54
- Published
- ·
- Modified
IvyForms for WordPress fails to block dangerous extensions in filterFiletypeAndExt and overrides WordPress MIME and extension checks. An authenticated user with the add_edit_forms capability (custom level or above) must first publish a File Upload field that allows an executable extension such as php. Any unauthenticated visitor can then upload that file through the public /wp-json/ivyforms/v1/form/submission/ REST route, which can lead to remote code execution. All releases through 1.5.1 are affected; no fixed version is stated.
What to do: No fixed release is stated for IvyForms through 1.5.1. Apply the vendor update for CVE-2026-109384 if one is issued.
| Product | Affected |
|---|---|
| IvyForms The Innovative Form Builder – IvyForms | all versions up to, and including, 1.5.1 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the allowed-extensions sanitizer and deliberate override of WordPress's native MIME and extension defences via a registered wp_check_filetype_and_ext filter. This makes it possible for authenticated attackers, with custom-level access and above, to upload files that may be executable, which makes remote code execution possible. An authenticated attacker with the custom add_edit_forms capability must first configure a File Upload field with a dangerous extension (e.g., php) in the allowed-extensions list; once that form is published, any unauthenticated visitor can trigger the actual file upload via the publicly accessible /wp-json/ivyforms/v1/form/submission/ REST route.
- Ecosystems
- WordPress
- Weakness
- CWE-434
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news
0 storiesNo ingested article mentions this CVE yet.