Executive brief
Piotnet Forms is a WordPress plugin used to build custom forms for websites. A security flaw allows unauthenticated attackers to upload malicious files to the web server because the plugin fails to properly restrict certain file types. If a form on the site includes a file upload field, an attacker could take full control of the website, potentially leading to data theft or a complete service shutdown.
Technical details
The Piotnet Forms plugin for WordPress (versions up to 2.1.40) contains an unrestricted file upload vulnerability within the 'piotnetforms_ajax_form_builder' function. The root cause is an incomplete extension blacklist that filters common extensions like .php and .exe but fails to block dangerous alternatives such as .phar or .phtml. An unauthenticated remote attacker can exploit this by submitting a form that contains a file upload field, allowing them to upload malicious scripts to the server. Successful exploitation can lead to remote code execution (RCE) and full system compromise.
Affected products
- Piotnet Piotnet Forms up to, and including, 2.1.40
Timeline
- 2026-05-19: disclosed: CVE published to NVD