Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104748— SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register

Quick assessment

Affected
wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件“SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications”在所有版本（含 3.10.0 及以下版本）中存在权限提升漏洞。该漏洞的成因如下： 1. AJAX 动作在处理角色分配时未进行任何权限检查； 2. 函数使用排除列表机制，但该列表遗漏了 字段； 3. 函数返回一个硬编码的默认数组，无论传入的 为何值，都会无条件启用元数据写入功能。 上述缺陷使得未认证的攻击者可以通过在标准注册字段中

CVSS 9.8 · Critical EPSS 0.65% · P50

Possible ATT&CK Techniques 2 AI

T1548.001 · Setuid and Setgid T1068.004

Affected Version Matrix 1

VendorProduct Version RangeStatus
wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications ≤ 3.10.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104748

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
Source: CVE Program / CVE List V5
Vulnerability Description
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications 0 ~ 3.10.0 -

II. Public POCs for CVE-2026-104748

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104748

请登录查看更多情报信息。

Other References for CVE-2026-104748 (7)

IV. Related Vulnerabilities

Same vendor: wpazleen
Same weakness: CWE-269

V. Comments for CVE-2026-104748

No comments yet

Leave a comment