CVE-2026-118423

What it is. WPScan's entry says the plugin does not validate the type of files uploaded through its form submissions, which lets an unauthenticated attacker upload PHP files to a web-accessible location and execute them. The three public repositories add the details. The thiscitze and Sable Research write-ups say the form handler is registered as the wplf_submit action on admin-ajax.php for logged-out visitors as well as logged-in users. They say uploads land in wp-content/uploads/ with names that keep the .php extension, unless the form is set to use the WordPress media library. The im0xfay write-up says two REST routes reach the same handler without a permission check.

Which versions. The CVE record covers 1.5.0.1 and earlier, and WPScan's entry names 1.5.0.1. WordPress.org's plugin page lists 1.4.3 as the latest release, so a site may be running an older version that is still in scope. Treat any installed copy of the plugin as affected.

Checks, in three tiers. The first decides exposure. The second and third decide priority. Run these only on sites your organization owns.

1. Is the plugin installed? This decides exposure. With WP-CLI, run this from the WordPress root.
   wp plugin list --name=wp-libre-form --fields=name,status,version
   Without WP-CLI, look for a wp-content/plugins/wp-libre-form folder. An installed copy is in scope whatever its version, because there is no fixed release.
2. Does a public page show one of its forms? All three repositories say the attack needs a published page with a Libre Form on it, usually through the [libre-form] shortcode. This lists published posts and pages that contain one.
   wp post list --post_type=any --post_status=publish --s=libre-form --fields=ID,post_title,url
   A match puts the site first in line. An installed plugin with no published form still has the flaw and still needs removing.
3. Does the web server run PHP files in the uploads folder? The thiscitze and Sable Research write-ups say the attack depends on this, and that it is the default. Check your web server configuration for a rule that blocks PHP in wp-content/uploads/. If there is none, the site is in the group the public code targets.

Public code. thiscitze/cve-2026-118423-poc and im0xfay/CVE-2026-118423 were posted on November 6 and include exploit code that uploads a PHP file and requests it to confirm it runs. Sable-Research/CVE-2026-118423-WP-Libre-Form, posted the same day, is a written analysis. We read all three and did not run any of them.

There is no patch to wait for. WPScan lists no known fix, and WordPress.org closed the plugin on September 8, 2026. Deactivate and delete the plugin.
wp plugin deactivate wp-libre-form
wp plugin delete wp-libre-form
Removing the plugin does not remove files that were already uploaded through it, so check the uploads folder afterward, as described under what to look for in logs. Sites that still need their forms can rebuild them in a maintained form plugin after the old one is gone.

No vendor or researcher has published indicators of exploitation for this CVE as of November 7, 2026. These come from the three public write-ups.

• PHP files in wp-content/uploads/. Sable Research says uploads are saved with names that start with lf_ followed by a timestamp and counter. This finds them.
  find wp-content/uploads -name 'lf_*.php'
  Any PHP file in the uploads folder deserves a look.
• POST requests to admin-ajax.php with action=wplf_submit that carry a file ending in .php, which Sable Research names as the request to watch for.
• Requests for .php files under wp-content/uploads/ soon after a form submission, which is how the public exploit code checks that its upload runs.

Is CVE-2026-118423 being exploited?

No exploitation has been reported, and it is not on CISA KEV as of November 7, 2026. Public exploit code was posted on November 6. We read it and did not run it.

Is there a fixed version?

No. WPScan lists no known fix, and WordPress.org closed the plugin on September 8, 2026. Deactivate and delete it.

Which versions are affected?

The CVE record WPScan filed covers 1.5.0.1 and earlier. WordPress.org lists 1.4.3 as the latest release, so treat any installed copy as affected.

Does an attacker need an account?

No. WPScan says the flaw is reachable without logging in, and the public write-ups say the form handler accepts submissions from logged-out visitors.

Is removing the plugin enough?

It closes the hole, but it does not delete files already uploaded through it. Check wp-content/uploads/ for PHP files after removing it.

Nov 7, 2026. First published. Public exploit code since November 6; no fix; no exploitation reported; not on CISA KEV.

• WPScan: WP Libre Form 1.5.0.1, Unauthenticated RCE via Arbitrary File Upload (Nov 3, 2026)
• CVE record for CVE-2026-118423 (WPScan CNA, Nov 6, 2026)
• NIST NVD: CVE-2026-118423 (Deferred, checked Nov 7)
• WordPress.org plugin page for WP Libre Form (closed Sep 8, 2026)
• Public code and analysis: thiscitze, im0xfay, Sable Research (Nov 6, 2026; read only, not run)
• CISA Known Exploited Vulnerabilities catalog (checked Nov 7)