CVE-2026-9815 — MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE

CVE-2026-9815

MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE PUBLISHED

Description (CNA)

The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.

Affected (CNA)

Vendor / product	Versions
Unknown / MagicForm	affected 0 through 0.1.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/043f449f-fc65-4218-83d2-7742e62f2af3/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.