File-upload flaw in a popular form plugin

A widely used form plugin for an open-source CMS lets attackers bypass extension checks and upload a web shell.

Summary

The plugin’s file field does not adequately validate double-extension files. An unauthenticated attacker can upload a PHP file to the server.

Impact

The website is taken over; exposed customer data and redirect/SEO-spam attacks are likely consequences.

Detection

.php files in the upload directory and unusual POST requests are indicators.

Recommended actions

Update the plugin to 5.2.0
Disable PHP execution in the upload directory
Block double-extension uploads with a WAF rule

Patch Released

CVE ID: CVE-2026-30415
Severity: High
CVSS score: 8.8 /10
Published: 18 October 2026
Affected system type: Web application / CMS
Patch status: Patch available
Active exploitation: Public PoC
Affected product/version: Form plugin, all versions before 5.2.0

Request an impact analysis for this vulnerability WhatsApp

Request an impact analysis for this vulnerability

Similar items

Patch Released

Local privilege escalation in the Linux kernel

A memory error in a kernel networking subsystem gives a local user root privileges.

CVE ID: CVE-2026-28803
Severity: High
CVSS score: 7.8 /10
Published: 15 October 2026
Patch status: Patch available

View

Patch Released

DLL side-loading in a corporate VPN client

The VPN client installer loads a DLL from an untrusted directory, enabling local privilege escalation.

CVE ID: CVE-2026-26391
Severity: Medium
CVSS score: 6.7 /10
Published: 8 October 2026
Patch status: Patch available

View

Patch Released

SSRF in enterprise wiki software

The preview feature lets server-side requests reach the cloud metadata service.

CVE ID: CVE-2026-31590
Severity: High
CVSS score: 8.1 /10
Published: 27 September 2026
Patch status: Patch available

View

View all — Security Bulletins / CVE Alerts

WhatsApp +90 212 555 71 30 iletisim@surnet.com.tr