CVE Intelligence
Analysis AI-assisted

CVE-2026-4883: Piotnet Forms (WordPress)

CVE-2026-4883 affects the Piotnet Forms plugin for WordPress in all versions up to and including 2.1.40. Missing file type validation in the form handling function lets unauthenticated users upload arbitrary files, which may enable remote code execution, but only on sites where a file field is present in a form. Wordfence rates it 9.8 (Critical) under CVSS 3.1, and the sources consulted report no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-4883 is a critical unrestricted file upload weakness (CWE-434) in the Piotnet Forms plugin for WordPress. According to the Wordfence record, the form handling function does not validate file types properly, and the plugin relies on an incomplete extension blocklist. The vulnerability is reachable without authentication when a form contains a file upload field.

Impact

  • The record describes arbitrary file upload on the affected server, which may lead to remote code execution.
  • The CVSS 3.1 vector reported by Wordfence is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8.
  • SSVC data in the record marks the technical impact as total and the vulnerability as automatable.

Affected products and versions

  • Product: Piotnet Piotnet Forms (WordPress plugin).
  • Affected versions: all versions up to and including 2.1.40, as stated in the record.
  • The record does not list fixed versions. Whether a patched release exists is unknown from the sources consulted.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record provided.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability in the record is 0.00869 (percentile 0.57697). SSVC exploitation is recorded as none.

Remediation and mitigation

  • Check the official vendor site and the Wordfence advisory for a fixed release newer than 2.1.40 and update as soon as one is available.
  • If a fix is not yet available, consider disabling the plugin or removing file upload fields from public forms until the risk is addressed.
  • Restrict who can write to the web root and make upload directories non-executable at the web server level, which limits the impact of any uploaded file.
  • Apply server-side file validation and review any custom form configurations that accept files.

Detection guidance

  • Review upload directories used by the plugin for unexpected files, especially server-side script files or files with unusual names.
  • Review web server logs for unusual requests to the plugin's form submission endpoints, particularly multipart uploads from unauthenticated sources.
  • Monitor for new files created in web-accessible directories and for unexpected outbound connections from the web server.

Limitations of the available information

  • The record does not provide the fixed version, a patch reference, or vendor advisory text beyond the homepage link.
  • The exact conditions for exploitation beyond the presence of a file field in a form are not detailed in the record.
  • The EPSS date in the record is later than the publication date and should be treated with caution.
  • Exploitation status is based only on the sources consulted and may change.

Frequently asked questions

Which Piotnet Forms versions are affected by CVE-2026-4883?

The record states that all versions up to and including 2.1.40 are affected. No fixed version is listed in the sources consulted.

Does the vulnerability require authentication?

According to the record, no authentication is required, but the exploit path only exists if a file field is added to the form.

Is this CVE known to be exploited in the wild?

The CISA KEV catalog does not list it in the record provided, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.