Description
The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the allowed-extensions sanitizer and deliberate override of WordPress's native MIME and extension defences via a registered wp_check_filetype_and_ext filter. This makes it possible for authenticated attackers, with custom-level access and above, to upload files that may be executable, which makes remote code execution possible. An authenticated attacker with the custom add_edit_forms capability must first configure a File Upload field with a dangerous extension (e.g., php) in the allowed-extensions list; once that form is published, any unauthenticated visitor can trigger the actual file upload via the publicly accessible /wp-json/ivyforms/v1/form/submission/ REST route.
Published: 2026-10-28
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote code execution
Action: Immediate Patch
AI Analysis

Impact

The IvyForms plugin for WordPress allows authenticated users with the custom add_edit_forms capability to configure file upload fields with any extension via the allowed-extensions list. Because the plugin bypasses WordPress’ native MIME and extension checks, malicious actors can set a dangerous extension such as .php. Once the form is published, the publicly accessible /wp-json/ivyforms/v1/form/submission/ REST route can be used by any visitor to upload that file, enabling the attacker to place and later execute arbitrary code on the host.

Affected Systems

IvyForms plugin for WordPress, versions up to and including 1.5.1, all installations of the plugin that have custom‐level permission for add_edit_forms enabled. This includes any site that has deployed the plugin without upgrading beyond 1.5.1.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.8, indicating a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user with elevated capability to configure the upload field, followed by any unauthenticated user uploading the crafted file via the exposed REST endpoint. Attackers can therefore achieve remote code execution with relatively easy steps once the conditions are met, making this a high-risk situation for any vulnerable site.

Generated by OpenCVE AI on October 28, 2026 at 08:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the IvyForms WordPress plugin to a version that has patched the file upload validation flaw. If a patch is unavailable, monitor the vendor’s release channel for an update and apply it as soon as possible.
  • If upgrading is not immediately possible, block or restrict access to the /wp-json/ivyforms/v1/form/submission/ REST endpoint—for example, by using a firewall rule, security plugin, or .htaccess rule—to prevent unauthenticated file uploads.
  • Revoke or restrict the add_edit_forms capability from users who do not require form creation privileges, ensuring that only trusted administrators can modify upload fields, thereby eliminating the ability to set hazardous extensions.

Generated by OpenCVE AI on October 28, 2026 at 08:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the allowed-extensions sanitizer and deliberate override of WordPress's native MIME and extension defences via a registered wp_check_filetype_and_ext filter. This makes it possible for authenticated attackers, with custom-level access and above, to upload files that may be executable, which makes remote code execution possible. An authenticated attacker with the custom add_edit_forms capability must first configure a File Upload field with a dangerous extension (e.g., php) in the allowed-extensions list; once that form is published, any unauthenticated visitor can trigger the actual file upload via the publicly accessible /wp-json/ivyforms/v1/form/submission/ REST route.
Title The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-28T06:45:12.110Z

Reserved: 2026-10-12T14:34:43.127Z

Link: CVE-2026-109384

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T07:16:44.570

Modified: 2026-10-28T07:16:44.570

Link: CVE-2026-109384

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T09:00:10Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type