CVE-2026-9815

The CVE concerns the WordPress plugin MagicForm up to version 0.1.3 . It allows unauthenticated arbitrary file upload via an insecure upload vector: when a form’s per-field extension allowlist is empty, an unauthenticated attacker can upload PHP files through an AJAX action and trigger remote cod...