WP Libre Form through 1.5.0.1 – Actively Exploited Unauthenticated RCE (CVE-2026-118423)
Remove or isolate this plugin immediately: WP Libre Form versions through 1.5.0.1 contain an unauthenticated arbitrary file upload vulnerability that can lead directly to remote code execution. The issue is tracked as CVE-2026-118423, carries a CVSS score of 10.0, is marked by Patchstack as known to be exploited, and currently has no official patch.
| Affected product | WP Libre Form |
|---|---|
| Affected versions | 1.5.0.1 and earlier |
| CVE | CVE-2026-118423 |
| Attack class | Unauthenticated arbitrary file upload leading to remote code execution |
| Severity | Critical, CVSS 10.0 |
| Fixed version | None available |
| Directory status | Closed on WordPress.org pending review |
Exploit path and exposure
WPScan reports that the plugin fails to validate the type of files uploaded through public form submissions. A remote visitor can therefore place an executable PHP file in a web-accessible location and request it to run code under the web server account. No WordPress account or user interaction is required.
The public proof of concept is being withheld until February 1, 2027, but Patchstack already marks the vulnerability as exploited. Patchstack’s label is its own exploitation intelligence and should not be confused with a CISA Known Exploited Vulnerabilities listing.
Immediate remediation
- Deactivate WP Libre Form immediately and remove it after preserving evidence needed for incident response.
- Replace its forms with a currently maintained alternative. Do not reactivate WP Libre Form until an official patched release is independently verified.
- Block PHP execution in upload and form-storage directories at the web server level.
- Review all web-accessible upload locations for executable files and compare WordPress core and plugin files against trusted checksums.
- If suspicious files are found, isolate the site, preserve logs, rebuild from known-good code, and rotate WordPress salts plus administrator, database, hosting and API credentials.
wp plugin get wp-libre-form --fields=name,status,version
wp plugin deactivate wp-libre-form
wp core verify-checksums
wp plugin verify-checksums --all
wp user list --role=administrator --fields=ID,user_login,user_registered
find wp-content/uploads -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) -printTemporary mitigation only: Deactivation plus a server rule that denies PHP execution in upload directories can reduce immediate exposure while the plugin is removed. Patchstack also offers a mitigation rule. None of these measures turns an unpatched plugin into a supported long-term deployment.
Indicators of compromise
- New PHP, PHTML or PHAR files inside
wp-content/uploadsor directories used by WP Libre Form. - POST requests to public WP Libre Form submission endpoints followed by direct requests to a newly uploaded file.
- Unexpected processes, outbound connections or file modifications owned by the PHP or web server account.
- Unknown administrator accounts, plugins, scheduled tasks, database options or modified theme files.
- Obfuscated PHP containing functions commonly used to decode or execute supplied content.
Verification and recovery
Confirm the plugin is inactive and removed, then verify that replacement forms work without exposing executable upload paths. Review access, WAF and application logs from at least November 3, 2026 onward, extending the period if the plugin accepted public uploads earlier. A clean scan is not sufficient by itself after remote code execution; validate files, users, credentials, scheduled tasks and database changes against a known-good baseline.
Sources
