Executive brief
Quform, a popular form-building plugin for WordPress, contains a critical security flaw that allows users with basic 'Subscriber' accounts to upload malicious files to the server. An attacker could use this to install a 'backdoor,' giving them full control over the website, the ability to steal customer data, or the power to shut down the service entirely. This vulnerability is highly dangerous as it can be used in automated attacks to compromise thousands of websites simultaneously.
Technical details
The Quform plugin for WordPress (versions <= 2.23.0) suffers from an unrestricted file upload vulnerability (CWE-434). The flaw allows authenticated users with Subscriber-level privileges to upload dangerous file types, such as PHP scripts, to the server. Because the plugin fails to properly validate or sanitize the uploaded files, an attacker can achieve remote code execution (RCE) by accessing the uploaded file. This vulnerability has a CVSS score of 9.9 due to the low complexity of the attack and the high impact on confidentiality, integrity, and availability. A patch is available in version 2.23.1.
Affected products
- ThemeCatcher Quform <= 2.23.0
Timeline
- 2026-06-18: disclosed: Reported by researcher daroo to Patchstack
- 2026-06-25: advisory: Patchstack published the vulnerability advisory
- 2026-06-26: patched: Version 2.23.1 released to address the issue