Critical SimpleForm flaw lets attackers upload files without logging in
SimpleForm 3.11.0 fixes CVE-2026-118235, a CVSS 9.8 unauthenticated file-upload bug affecting versions 3.10.2 and below.
A critical vulnerability in the WordPress form plugin SimpleForm was disclosed on October 31, 2026, tracked as CVE-2026-118235 and rated 9.8 on the CVSS 3.1 scale, according to dailysecu.com. The flaw lets an unauthenticated attacker upload disallowed file types to the server.
All SimpleForm versions 3.10.2 and below are affected. Because no authentication is required, the flaw can be reached without an account on the site.
The plugin's developers have released SimpleForm 3.11.0, which adds stronger file-type validation and protection for the upload directory.
Depending on how the server is configured, successful exploitation could lead to remote code execution, website defacement, theft of personal data or malware installation.
Quick answers
Which SimpleForm versions are affected by CVE-2026-118235?
SimpleForm versions 3.10.2 and below are affected.
How severe is the SimpleForm vulnerability?
It has a CVSS 3.1 score of 9.8, the critical range.
Which version fixes the flaw?
SimpleForm 3.11.0, which adds stronger file-type validation and upload directory protection.