Executive brief
MagicForm, a WordPress plugin used for creating forms, contains a security flaw that allows unauthorized users to upload malicious files to a website. If a form is configured without specific file type restrictions, an attacker can upload and run harmful code on the server. This could lead to a complete takeover of the website, data theft, or service disruption.
Technical details
The MagicForm plugin for WordPress (up to version 0.1.3) is vulnerable to unauthenticated arbitrary file upload. The vulnerability exists in an AJAX action that fails to properly validate file types when a form's per-field extension allowlist is not explicitly configured (left empty). An attacker can exploit this by sending a specially crafted request to the vulnerable AJAX endpoint, allowing them to upload PHP scripts. Successful exploitation results in Remote Code Execution (RCE) on the underlying web server. As of the advisory date, no official fix has been released.
Affected products
- Unknown MagicForm <= 0.1.3
Timeline
- 2026-05-28: disclosed: Vulnerability publicly published by WPScan
- 2026-06-18: advisory: CVE published to NVD dataset