CVE-2026-104748

🗓️ 14 Oct 2026 07:43:35Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 31 Views🌐 WEB

Unauthenticated privilege escalation in SimpleForm via wp_ajax_nopriv_simpleform_wp_register.

Reporter	Title	Published	Views	Family All 10
GithubExploit	Exploit for CVE-2026-104748	14 Oct 202609:59	–	githubexploit
GithubExploit	Exploit for CVE-2026-104748	14 Oct 202616:33	–	githubexploit
Circl	CVE-2026-104748	14 Oct 202608:50	–	circl
Cvelist	CVE-2026-104748 SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register	14 Oct 202607:43	–	cvelist
EUVD	EUVD-2026-100911	14 Oct 202607:43	–	euvd
NVD	CVE-2026-104748	14 Oct 202608:17	–	nvd
Patchstack	WordPress SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment vulnerability	14 Oct 202607:43	–	patchstack
Positive Technologies	PT-2026-113710	14 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-104748: Improper Privilege Management	14 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-104748 SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register	14 Oct 202607:43	–	vulnrichment

[
  {
    "vendor": "wpazleen",
    "product": "SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.10.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php
plugins	www.plugins.trac.wordpress.org/changeset/3726513/simple-form/trunk/app/Integrations/WordPressAuth.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97
plugins	www.plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php
plugins	www.plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Assets.php
plugins	www.plugins.svn.wordpress.org/simple-form/trunk/
plugins	www.plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php

Parameter	Position	Path	Description	CWE
form_id	request body	wp-admin/admin-ajax.php	Unauthenticated attacker can escalate privileges by abusing the wp_ajax_nopriv_simpleform_wp_register AJAX endpoint via admin-ajax.php to create an Administrator-level WordPress account by submitting wp_capabilities[administrator]=1 along with standard registration fields.	CWE-269
username	request body	wp-admin/admin-ajax.php	Unauthenticated attacker can escalate privileges by abusing the wp_ajax_nopriv_simpleform_wp_register AJAX endpoint via admin-ajax.php to create an Administrator-level WordPress account by submitting wp_capabilities[administrator]=1 along with standard registration fields.	CWE-269
email	request body	wp-admin/admin-ajax.php	Unauthenticated attacker can escalate privileges by abusing the wp_ajax_nopriv_simpleform_wp_register AJAX endpoint via admin-ajax.php to create an Administrator-level WordPress account by submitting wp_capabilities[administrator]=1 along with standard registration fields.	CWE-269
password	request body	wp-admin/admin-ajax.php	Unauthenticated attacker can escalate privileges by abusing the wp_ajax_nopriv_simpleform_wp_register AJAX endpoint via admin-ajax.php to create an Administrator-level WordPress account by submitting wp_capabilities[administrator]=1 along with standard registration fields.	CWE-269
confirm_password	request body	wp-admin/admin-ajax.php	Unauthenticated attacker can escalate privileges by abusing the wp_ajax_nopriv_simpleform_wp_register AJAX endpoint via admin-ajax.php to create an Administrator-level WordPress account by submitting wp_capabilities[administrator]=1 along with standard registration fields.	CWE-269
wp_capabilities[administrator]	request body	wp-admin/admin-ajax.php	Unauthenticated attacker can escalate privileges by abusing the wp_ajax_nopriv_simpleform_wp_register AJAX endpoint via admin-ajax.php to create an Administrator-level WordPress account by submitting wp_capabilities[administrator]=1 along with standard registration fields.	CWE-269

15 Oct 2026 17:17Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

EPSS0.00833

SSVC

CWE-269