CVE Intelligence
Analysis AI-assisted

CVE-2026-56058: Quform WordPress Plugin: Subscriber Arbitrary File Upload

The record describes an arbitrary file upload weakness (CWE-434) in the Quform WordPress plugin for versions up to and including 2.23.0, reachable by users with the Subscriber role. The CNA Patchstack scored it CVSS 3.1 9.9 (critical). The record lists no structured fixed version and no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an arbitrary file upload vulnerability in the Quform plugin for WordPress, affecting versions up to and including 2.23.0. The weakness is classified as CWE-434, unrestricted upload of a file with a dangerous type. According to the record, the flaw is reachable by a user with the Subscriber role.

Impact

  • The CNA Patchstack assigned a CVSS 3.1 base score of 9.9 (critical), with high confidentiality, integrity and availability impact and a changed scope.
  • In general terms, an arbitrary file upload flaw can let a low-privilege authenticated user place files on a server that the application should not accept. The record does not detail the specific consequences for this case.

Affected products and versions

  • Product: Quform, a WordPress plugin, as stated in the record description and the Patchstack reference.
  • Versions: described as up to and including 2.23.0.
  • The record contains no structured affected version ranges and no fixed versions.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Identify whether Quform is installed on your WordPress sites and which version is running.
  • Check the vendor and the Patchstack reference for an updated release. The record does not identify a fixed version, and a missing fixed version does not mean no fix exists.
  • Until a verified fix is applied, review which accounts hold Subscriber-level roles and how registration is configured, and limit upload-capable features to trusted roles.
  • Review upload directories for unexpected files and keep current backups.

Detection guidance

  • Review web server and application logs for unusual upload requests from low-privilege accounts.
  • Look for unexpected files in upload or plugin-related directories, especially executable or script file types.
  • Monitor file integrity on the web root.

Limitations of the available information

  • The record has no structured affected or fixed version data.
  • The source status is Deferred, and the record contains no SSVC data and no CISA ADP data.
  • The EPSS values are present but do not, by themselves, indicate exploitation.
  • Technical details of the vulnerable code path are not in the record.

Frequently asked questions

Is this Quform vulnerability being actively exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation in the wild appears in the sources consulted.

Which Quform versions are affected?

The record describes versions up to and including 2.23.0. It does not provide structured version ranges or a fixed version.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.