WP Libre Form ≤1.5.0.1: unauthenticated arbitrary file upload → RCE (CVE-2026-118423, CVSS 10) — remove the plugin, no official patch

confirmed vendor intel (Patchstack database, published Nov 6; CVE-2026-118423, CVSS 10, unauthenticated); Patchstack marks exploited — this is Patchstack KEV, not a CISA KEV listing; no official plugin patch yet2026-11-06

WP Libre Form ≤1.5.0.1: unauthenticated arbitrary file upload → RCE (CVE-2026-118423, CVSS 10) — remove the plugin, no official patch

Do now: deactivate and remove WP Libre Form; preserve forensic copies of upload dirs if you need IR; replace forms with a maintained plugin.
Block PHP execution under upload / form-storage paths at the web server even after removal.
Hunt webroots for unexpected .php under form upload locations and review access logs from at least early November.
Credit (Patchstack): Enrico Marcolini, Claudio Marchesini, Dottor Marc.

Sources: Patchstack: WP Libre Form ≤1.5.0.1 unauthenticated RCE / arbitrary file upload (CVE-2026-118423) · CVE Program: CVE-2026-118423