CVE-2026-104748

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-269

Impact

Unauthenticated remote attackers can create a full Administrator account on your WordPress site. All they need is network access to fetch a public frontend nonce and submit a registration payload.

Root cause

The registration AJAX handler fails to check user capabilities, and the custom user meta saving logic omits wp_capabilities from its field exclusion list while enabling meta writes by default.

Affected systems

SimpleForm WordPress plugin versions up to and including 3.10.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade SimpleForm to a version newer than 3.10.0, or deactivate the plugin immediately if an update is not yet available.

shell

$ wp plugin update simple-form || wp plugin deactivate simple-form

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-104748