CVE-2026-9815: MagicForm WordPress Plugin Unauthenticated File Upload & Code Execution

Technical summary

CVE-2026-9815 is an unrestricted file upload vulnerability in MagicForm through version 0.1.3. The vulnerability exists in an unauthenticated AJAX endpoint that processes file uploads. When a form's per-field extension allowlist is empty, the plugin fails to implement proper file-type validation, allowing attackers to bypass upload restrictions and submit PHP files. Successful exploitation results in arbitrary PHP code execution with the privileges of the web server process. The CVSS 3.1 score of 6.5 (MEDIUM) reflects network-based attack vector, no authentication requirement, low complexity, and integrity/confidentiality impact without availability impact.

Business impact

Organizations using MagicForm are at risk of server compromise, data breach, and website defacement. An attacker gaining code execution can steal customer data, modify website content, inject malware, or use the compromised server as a pivot point to attack internal networks. The lack of authentication requirement means this vulnerability can be exploited by any internet user discovering a vulnerable form. Website downtime, reputation damage, regulatory fines (under GDPR, CCPA, etc.), and incident response costs amplify the business risk, especially for e-commerce and lead-generation sites relying on form submissions.

Affected systems

WordPress installations with the MagicForm plugin version 0.1.3 or earlier are affected. The vulnerability is triggered only when form administrators have configured one or more upload fields with an empty extension allowlist, making adoption and exploitability dependent on configuration choices. Any plugin installation with this configuration is directly vulnerable; sites using forms without upload fields are not affected by this particular flaw.

Exploitability

Exploitation is straightforward and requires no special tools or credentials. An attacker can craft a simple HTTP POST request to the vulnerable AJAX endpoint with a PHP file payload, triggering immediate code execution. The attack is pre-authentication, meaning it can be discovered and executed by scanning for MagicForm installations on the open web. No user interaction or social engineering is required. Given the ease of exploitation and the critical nature of the outcome (code execution), this vulnerability poses significant practical risk despite the MEDIUM CVSS rating.

Remediation

Site administrators must immediately update MagicForm to a patched version released after 0.1.3. Verify the specific patch version against the official MagicForm plugin repository and release notes. As an interim measure, disable any MagicForm upload fields until patching is complete, or configure strict file extension allowlists (e.g., whitelist only jpg, png, pdf) to restore validation. Website owners should also scan their server for suspicious PHP files or unexpected uploads in the form submissions directory.

Patch guidance

Upgrade the MagicForm plugin to the latest available version beyond 0.1.3 via the WordPress plugin management interface or by downloading directly from the official plugin repository. Verify compatibility with your WordPress version before updating. After patching, test all forms, especially those with file uploads, to ensure functionality is restored. Consider reviewing form configurations to ensure extension allowlists are explicitly set rather than left empty.

Detection guidance

Monitor web server logs for suspicious POST requests to AJAX endpoints handling file uploads (typically paths including 'wp-admin/admin-ajax.php' with action parameters related to file uploads). Look for uploads of unusual file types (particularly .php files) to plugin directories or upload folders. Check upload directories for unexpected PHP files created during the vulnerability window. Endpoint Detection and Response (EDR) tools should flag unexpected PHP process execution from the web server user context. Web Application Firewalls can be configured to reject file uploads with PHP extensions to upload endpoints.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the practical risk is elevated due to unauthenticated pre-attack access, trivial exploitation, and the severity of code execution outcome. This vulnerability should be treated as HIGH priority for any organization running MagicForm. Delay in patching substantially increases the window for compromise, especially for publicly accessible WordPress sites. Given the lack of complexity and authentication barriers, remediation should occur within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability with no authentication requirement and low attack complexity—factors that would typically elevate the score. However, the score caps at MEDIUM because the impact scope is unchanged (only the vulnerable service is impacted, not the broader system) and integrity/confidentiality impact, while real, is assessed as localized rather than system-wide. In practical security terms, code execution vulnerabilities in production systems warrant urgent attention regardless of CVSS severity band; this should be treated as a critical priority for patching.

Frequently asked questions