SimpleForm up to 3.10.0 – Unauthenticated Administrator Account Creation (CVE-2026-104748)
SimpleForm versions through 3.10.0 contain a critical unauthenticated privilege-escalation vulnerability that can let a remote attacker create a WordPress user with Administrator capabilities. Wordfence assigned CVE-2026-104748 a CVSS score of 9.8. Sites using the plugin should update to 3.10.1 immediately and audit privileged accounts.
Vulnerability summary
- Product: SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
- Plugin slug:
simple-form - Affected versions: 3.10.0 and earlier
- Fixed version: 3.10.1
- CVE: CVE-2026-104748
- Severity: Critical, CVSS 9.8
- Authentication required: No
- Impact: Creation of an Administrator account and full site takeover
How the flaw works
According to Wordfence, the unauthenticated AJAX registration action simpleform_wp_register accepts user metadata without adequately protecting WordPress capability fields. The vulnerable exclusion logic does not block the wp_capabilities key. Because the registration nonce is exposed to visitors on front-end pages, an unauthenticated request can reach the handler and assign Administrator capabilities to a newly created account.
This is a mass-assignment weakness in a security-sensitive registration path. An attacker does not need an existing WordPress account. Successful exploitation provides normal administrator access, which can then be used to install plugins, alter content, add persistence, or access stored site data.
Immediate remediation
- Update SimpleForm to version 3.10.1 or later.
- If an immediate update is impossible, deactivate the plugin until it can be patched. Disabling only a visible form is not equivalent to removing the vulnerable handler.
- Audit all Administrator accounts, especially accounts created after the vulnerable release was installed.
- Invalidate active sessions and rotate administrator passwords if an unknown privileged account or suspicious activity is found.
- Review recently installed plugins, modified theme files, scheduled tasks, and outbound redirects for follow-on persistence.
The vendor changelog says 3.10.1 adds strict form-ID allowlisting and database-backed field validation, isolates custom user metadata under a simpleform_ prefix, and disables automatic login and custom user-meta saving by default.
Verification with WP-CLI
wp plugin get simple-form --fields=name,status,version,update,update_version
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=table
wp core verify-checksums
wp plugin verify-checksums --allConfirm that the installed version is at least 3.10.1. Compare the Administrator list with your approved account inventory and investigate recently registered users. Checksum warnings require review, but premium plugins, custom plugins, and locally modified files may not have public checksums.
Indicators to review
- Administrator accounts that were not created through your normal process.
- New users registered shortly before plugin installation, file changes, redirects, or settings changes.
- Requests to
admin-ajax.phpusing thesimpleform_wp_registeraction. - Unexpected changes to user capability metadata or unfamiliar security-plugin exclusions.
At publication time, WPDeeply did not find authoritative confirmation that CVE-2026-104748 is listed in CISA’s Known Exploited Vulnerabilities catalog. That absence does not reduce the need to patch: the flaw is remotely reachable, unauthenticated, and has direct administrative impact.
Sources
