VulnSocial

CVE-2026-10818General

MEDIUMCVSS 8.1 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-07-25); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01122Mentions · 2026-07-25: 2Mentions · 2026-07-26: 2Mentions · 2026-10-06: 1PoC Mentioned / Linked · 2026-07-26: 1Exploit Tool / Code · 2026-07-26: 1Patch / Workaround · 2026-07-25: 1Technical Details · 2026-07-25: 2Technical Details · 2026-07-26: 207-2507-2610-06
Signal classification4 categories
General
125.0%
Patch
125.0%
Disclosure
125.0%
PoC
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-252
General1Patch1
2026-07-262
Disclosure1PoC1
Full discourse5 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-10818 - high 🚨 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Upload > WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitra... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-10818 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet discloses CVE-2026-10818, an unauthenticated arbitrary file upload in WPForms Pro <= 1.10.1.1, and links to a Project Discovery Nuclei template library entry; no patch, exploit, or active exploitation is mentioned.

    01073526
    1.4K followersView on X
  • Nxploited@Nxploited
    PoC

    CVE-2026-10818 — WPForms Pro ≤ 1.10.1.1 Unauthenticated Arbitrary File Write → RCE via Chunked Upload Ordering Flaw PoC: https://github.com/Nxploited/CVE-2026-10818 #WordPress #RCE #ArbitraryFileUpload #0day #BugBounty #InfoSec #CyberSecurity #PenTest #WebSecurity #Exploit #RedTeam #OffSec

    Post summary

    A PoC demonstrates an unauthenticated file‑write flaw in WPForms Pro that can lead to remote code execution, but no active exploitation or patch information is provided.

    020541.2K
    125 followersView on X
  • PJ@Npj8448
    Disclosure

    Vulnerabilities in products from vendors like Redis, Knot Resolver, and WPForms Pro were identified, including CVE-2026-66373, CVE-2026-66374, and CVE-2026-10818, which could be exploited for remote code execution or arbitrary file upload. #cve

    Post summary

    New vulnerabilities marked as CVE-2026-66373, CVE-2026-66374, and CVE-2026-10818 were identified in Redis, Knot Resolver, and WPForms Pro, potentially enabling remote code execution or arbitrary file upload.

    1000057
    50 followersView on X
  • ADK Cyber@ADKCyber
    Patch

    WPForms Pro (up to 1.10.1.1) has a high-severity arbitrary file upload vulnerability (CVE-2026-10818, CVSS 8.1). Update the plugin immediately if in use. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/3PaXFWXxam

    Post summary

    The tweet announces a high‑severity arbitrary file upload flaw in WPForms Pro (CVE‑2026‑10818), urging users to update the plugin immediately.

    0000036
    90 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-10818 Arbitrary File Upload in WPForms Pro Plugin for WordPress Up to 1.10.1.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-10818

    Post summary

    The entry lists CVE-2026-10818, identifying an arbitrary file upload flaw in WPForms Pro plugin up to version 1.10.1.1, without revealing PoC, exploit, patch, or active usage details.

    00000131
    4.1K followersView on X

Explore more

Back to dashboard