What the vulnerability does
01Description
The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all versions up to, and including, 2.1.40. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form.
Explanation of Vulnerability in Simple Terms
02Summary
Piotnet Forms versions 2.1.40 and earlier allow unauthenticated attackers to upload files without restriction. An attacker can upload malicious files to the server over the network without needing credentials or user interaction. This can lead to remote code execution, data theft, or site takeover depending on where uploaded files are stored and executed.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files to the server without authentication, potentially executing malicious code.
Potential impact on your site
04Site Impact
Attackers can upload and execute malicious code, steal data, or completely compromise the site.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 19, 2026
CVE published
May 19, 2026
Record updated
