Search

Find a vulnerability

Search criteria

    2 vulnerabilities by sameh101

    CVE-2026-125055 (GCVE-0-2026-125055)

    Vulnerability from nvd – Published: 2026-11-13 09:35 – Updated: 2026-11-13 09:35
    VLAI
    Title
    Chatterbug Forms <= 1.0.2 - Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission
    Summary
    The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-434 - Unrestricted Upload of File with Dangerous Type
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2451 records in the last 180 days details
    References
    Impacted products
    Credits
    samathakeeling
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Chatterbug Forms \u2013 Fast, Flexible WordPress Form Builder",
          "vendor": "sameh101",
          "versions": [
            {
              "lessThanOrEqual": "1.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "samathakeeling"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Chatterbug Forms \u2013 Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file\u0027s own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:35:13.330Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7819c1fa-884b-4f1d-ba63-84057bf6da84?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L422"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L331"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L510"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L308"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3794492/chatterbug-forms/trunk/chatterbug-forms.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-10T08:32:15.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-12T21:10:49.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Chatterbug Forms \u003c= 1.0.2 - Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-125055",
    "datePublished": "2026-11-13T09:35:13.330Z",
    "dateReserved": "2026-11-09T16:27:26.174Z",
    "dateUpdated": "2026-11-13T09:35:13.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125055 (GCVE-0-2026-125055)

    Vulnerability from cvelistv5 – Published: 2026-11-13 09:35 – Updated: 2026-11-13 09:35
    VLAI
    Title
    Chatterbug Forms <= 1.0.2 - Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission
    Summary
    The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-434 - Unrestricted Upload of File with Dangerous Type
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2451 records in the last 180 days details
    References
    Impacted products
    Credits
    samathakeeling
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Chatterbug Forms \u2013 Fast, Flexible WordPress Form Builder",
          "vendor": "sameh101",
          "versions": [
            {
              "lessThanOrEqual": "1.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "samathakeeling"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Chatterbug Forms \u2013 Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file\u0027s own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:35:13.330Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7819c1fa-884b-4f1d-ba63-84057bf6da84?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L422"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L331"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L510"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L308"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3794492/chatterbug-forms/trunk/chatterbug-forms.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-10T08:32:15.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-12T21:10:49.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Chatterbug Forms \u003c= 1.0.2 - Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-125055",
    "datePublished": "2026-11-13T09:35:13.330Z",
    "dateReserved": "2026-11-09T16:27:26.174Z",
    "dateUpdated": "2026-11-13T09:35:13.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}