1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
Not on CISA's list of exploited flaws, and not in the news we track.
10.0of 10, critical
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-118423. Nothing runs until you send it.
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.