---
title: WP Libre Form ≤1.5.0.1: unauthenticated arbitrary file upload → RCE (CVE-2026-118423, CVSS 10) — remove the plugin, no official patch | ctxsec
url: https://ctxsec.com/items/wp-libre-form-cve-2026-118423-unauth-file-upload-rce-no-patch
description: "Patchstack published CVE-2026-118423 against the WordPress WP Libre Form plugin through 1.5.0.1: an unauthenticated arbitrary file upload that can lead to remote code execution (CVSS 10). Patchstack marks it known-exploited in its own KEV labeling and says there is no official patched version yet; the plugin directory listing is closed pending review. Public PoC is being withheld (WPDeeply notes until Feb 1, 2027). Do not confuse Patchstack's exploitation flag with a CISA Known Exploited Vulnerabilities entry \u2014 CISA has not listed this CVE in the catalog refreshes we checked today."
status: "confirmed vendor intel (Patchstack database, published Nov 6; CVE-2026-118423, CVSS 10, unauthenticated); Patchstack marks exploited — this is Patchstack KEV, not a CISA KEV listing; no official plugin patch yet"
published: 2026-11-06
---

> Patchstack published CVE-2026-118423 against the WordPress WP Libre Form plugin through 1.5.0.1: an unauthenticated arbitrary file upload that can lead to remote code execution (CVSS 10). Patchstack marks it known-exploited in its own KEV labeling and says there is no official patched version yet; the plugin directory listing is closed pending review. Public PoC is being withheld (WPDeeply notes until Feb 1, 2027). Do not confuse Patchstack's exploitation flag with a CISA Known Exploited Vulnerabilities entry — CISA has not listed this CVE in the catalog refreshes we checked today.

[← Cybersecurity News](/news) · [markdown](/items/wp-libre-form-cve-2026-118423-unauth-file-upload-rce-no-patch.md)

confirmed vendor intel (Patchstack database, published Nov 6; CVE-2026-118423, CVSS 10, unauthenticated); Patchstack marks exploited — this is Patchstack KEV, not a CISA KEV listing; no official plugin patch yet

2026-11-06

### WP Libre Form ≤1.5.0.1: unauthenticated arbitrary file upload → RCE (CVE-2026-118423, CVSS 10) — remove the plugin, no official patch

- **Do now:** deactivate and remove WP Libre Form; preserve forensic copies of upload dirs if you need IR; replace forms with a maintained plugin.
- Block PHP execution under upload / form-storage paths at the web server even after removal.
- Hunt webroots for unexpected `.php` under form upload locations and review access logs from at least early November.
- Credit (Patchstack): Enrico Marcolini, Claudio Marchesini, Dottor Marc.

Sources: [Patchstack: WP Libre Form ≤1.5.0.1 unauthenticated RCE / arbitrary file upload (CVE-2026-118423)](https://patchstack.com/database/wordpress/plugin/wp-libre-form/vulnerability/wordpress-wp-libre-form-plugin-1-5-0-1-unauthenticated-rce-vulnerability) · [CVE Program: CVE-2026-118423](https://www.cve.org/CVERecord?id=CVE-2026-118423)