CVE-2026-10818 — WPForms Pro Unauthenticated Arbitrary File Upload (→ RCE)¶

Key facts

CVE-2026-10818 is a High (8.1) vulnerability: WPForms Pro Unauthenticated Arbitrary File Upload (→ RCE). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-10818
Severity	High (8.1)
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2026/CVE-2026-10818/

Details¶

CVE-2026-10818 is a High (8.1) vulnerability: WPForms Pro Unauthenticated Arbitrary File Upload (→ RCE). This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.


CVSS v3	8.1 (High)
CWE	CWE-434 Unrestricted Upload of File with Dangerous Type
Affected	WPForms Pro ≤ 1.10.1.1 (WordPress plugin)
Vector	Network / Unauthenticated

For authorized security testing, CTF, and research only.

Summary¶

The ajax_chunk_upload_finalize function validates the file type after chunk metadata and contents have already been written to disk, and the assembled file is not deleted when validation fails. An unauthenticated attacker can therefore upload an executable (e.g. .php) file that lands and persists on disk, enabling remote code execution.

Root cause¶

Order-of-operations flaw: write chunks → assemble → validate. The correct order is validate → assemble, and any validation failure must remove the partially-assembled artifact. The fix validates the declared type/extension before finalizing and deletes the assembled file on rejection.

Detection (`poc.py`)¶

Non-destructive: performs the chunked upload of a benign marker file named *.php whose body is an inert comment (no executable payload). It then checks whether the assembled .php file persists / is retrievable. VULNERABLE if the disallowed file survives finalization.

The uploaded file contains no webshell — only a random marker string used to confirm persistence.

python poc.py --target http://TARGET:8080

Lab¶

docker compose up --build      # vulnerable on :8080, patched on :8081
./run-tests.sh

Remediation¶

Update WPForms Pro beyond 1.10.1.1.
Deny execution of files in the uploads directory and reject executable extensions (see prevention/).

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-10818, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-10818 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2026-10818 — WPForms Pro arbitrary file upload (Snort/Suricata)
# Detect the WPForms chunk upload/finalize carrying an executable filename.

alert http $EXTERNAL_NET any -> $HOME_NET any ( \
    msg:"CVE-2026-10818 WPForms chunk upload of executable (.php) file"; \
    flow:established,to_server; http.method; content:"POST"; \
    http.uri; content:"/wp-admin/admin-ajax.php"; \
    http.request_body; content:"wpforms_upload_chunk"; nocase; \
    http.request_body; pcre:"/filename=\"[^\"]+\.(php|phtml|php[0-9]|phar|pht)\"/i"; \
    classtype:web-application-attack; sid:2026010818; rev:1; )

alert http $EXTERNAL_NET any -> $HOME_NET any ( \
    msg:"CVE-2026-10818 WPForms finalize of executable upload"; \
    flow:established,to_server; http.method; content:"POST"; \
    http.uri; content:"/wp-admin/admin-ajax.php"; \
    http.request_body; content:"wpforms_file_chunks_finalize_upload"; nocase; \
    http.request_body; pcre:"/name=[^&]*\.(php|phtml|php[0-9]|phar|pht)/i"; \
    classtype:web-application-attack; sid:2026010819; rev:1; )

:material-file-download: prevention/snort.rules

/*
 * CVE-2026-10818 — WPForms Pro arbitrary file upload
 * Scan the WordPress uploads directory for PHP webshells dropped via the flaw.
 */

rule CVE_2026_10818_uploaded_php_webshell
{
    meta:
        cve = "CVE-2026-10818"
        description = "PHP webshell dropped in WPForms/WordPress uploads"
        severity = "critical"
    strings:
        $php = "<?php" ascii
        $s1 = /\b(system|exec|shell_exec|passthru|popen|proc_open)\s*\(/ nocase
        $s2 = "eval(" ascii nocase
        $s3 = "base64_decode(" ascii nocase
        $s4 = /\$_(GET|POST|REQUEST|COOKIE)\s*\[/
        $marker = "CVE-2026-10818 benign detection marker" ascii  // this repo's PoC
    condition:
        // benign PoC marker OR a real shell pattern
        $marker or ($php and (any of ($s1, $s2) and $s4) or ($php and $s3 and $s4))
}

:material-file-download: prevention/yara.yar

# CVE-2026-10818 — WPForms Pro arbitrary file upload
# Two defenses: (1) never execute anything under the uploads dir, and
# (2) reject executable uploads at the chunk-upload endpoint.

# 1) Kill code execution in the WordPress uploads tree (defeats dropped webshells).
location ~* ^/wp-content/uploads/.*\.(php|phtml|php[0-9]|phar|pht)$ {
    deny all;
    return 403;
}

# 2) Block uploads whose declared filename is executable at the ajax endpoint.
location = /wp-admin/admin-ajax.php {
    if ($request_body ~* "filename=\"[^\"]+\.(php|phtml|php[0-9]|phar|pht)\"") {
        return 403;
    }
    client_body_in_single_buffer on;
    client_max_body_size 25m;
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
}

:material-file-download: prevention/nginx.conf

# CVE-2026-10818 — WPForms Pro arbitrary file upload (Apache + ModSecurity)

# 1) Disable PHP execution under the uploads directory.
<DirectoryMatch "/wp-content/uploads/">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|php[0-9]|phar|pht)$">
        Require all denied
    </FilesMatch>
</DirectoryMatch>

# 2) ModSecurity: block WPForms chunk uploads with an executable filename.
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "id:2026010818,phase:2,deny,status:403,log,\
     msg:'CVE-2026-10818 WPForms executable upload blocked',chain"
    SecRule ARGS:action "@rx wpforms_(upload_chunk|file_chunks_finalize_upload)" "chain"
    SecRule FILES_NAMES|ARGS:name "@rx \.(php|phtml|php[0-9]|phar|pht)$" "t:lowercase"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-10818?¶

CVE-2026-10818 is a High (8.1) vulnerability: WPForms Pro Unauthenticated Arbitrary File Upload (→ RCE). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-10818?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-10818?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.