medium6.5
CVE-2026-9815
The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-fie…
Impact
The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.
Affected products
| Product | Affected versions |
|---|---|
| MagicForm WordPress Plugin | through 0.1.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.