Vulnerability Bulletins |
CVE-2026-9815 |
|
| Affected software | WORDPRESS |
| The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-9815 | |