---
title: Tip: if WP Libre Form is installed, deactivate/delete it today and deny PHP under upload paths | ctxsec
url: https://ctxsec.com/items/tip-remove-wp-libre-form-block-php-in-uploads
description: "CVE-2026-118423 is an unauthenticated file-upload RCE in WP Libre Form \u22641.5.0.1 with no official fix. The safe action is removal, not 'wait for a patch'. After removal, keep a server-level rule that refuses to execute PHP (and other script handlers) inside wp-content uploads and any form-storage directories the plugin used."
status: "operational guidance (Patchstack CVE-2026-118423, Nov 6); no official plugin patch"
published: 2026-11-06
---

> CVE-2026-118423 is an unauthenticated file-upload RCE in WP Libre Form ≤1.5.0.1 with no official fix. The safe action is removal, not 'wait for a patch'. After removal, keep a server-level rule that refuses to execute PHP (and other script handlers) inside wp-content uploads and any form-storage directories the plugin used.

[← Tips & Guides](/tips) · [markdown](/items/tip-remove-wp-libre-form-block-php-in-uploads.md)

operational guidance (Patchstack CVE-2026-118423, Nov 6); no official plugin patch

2026-11-06

### Tip: if WP Libre Form is installed, deactivate/delete it today and deny PHP under upload paths

- wp-admin → Plugins → Deactivate → Delete WP Libre Form (export form definitions first if you still need them).
- Nginx/Apache: `location ~* /wp-content/uploads/.*\.php$ { deny all; }` (plus any plugin-specific upload path).
- Hunt: unexpected `.php`/`.phtml` under uploads since at least Nov 3; compare core/plugin checksums; rotate salts and admin credentials if you find webshells.

Sources: [Patchstack: WP Libre Form ≤1.5.0.1 (CVE-2026-118423)](https://patchstack.com/database/wordpress/plugin/wp-libre-form/vulnerability/wordpress-wp-libre-form-plugin-1-5-0-1-unauthenticated-rce-vulnerability)