SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
Summary
| CVE | CVE-2026-104748 |
|---|---|
| State | PUBLISHED |
| Assigner | Wordfence |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-14 08:17:02 UTC |
| Updated | 2026-10-14 14:26:59 UTC |
| Description | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-269 | CWE-269 CWE-269 Improper Privilege Management
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Wpazleen | SimpleForm Form Maker To Chat Apps With Quiz Poll And Multi Lead Notifications | affected 3.10.0 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| plugins.trac.wordpress.org/changeset/3726513/simple-form/trunk/app/Integrations/WordPres... | [email protected] | plugins.trac.wordpress.org | |
| www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086... | [email protected] | www.wordfence.com | |
| plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAut... | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Assets.php | [email protected] | plugins.trac.wordpress.org | |
| plugins.svn.wordpress.org/simple-form/trunk | [email protected] | plugins.svn.wordpress.org | |
| plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAut... | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAut... | [email protected] | plugins.trac.wordpress.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Sebastian Albrecht (mySebbe) (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-10-03T14:35:51.000Z | Vendor Notified |
| CNA | 2026-10-13T19:40:33.000Z | Disclosed |
There are currently no legacy QID mappings associated with this CVE.