CVE-2026-10818

CVE-2026-10818 is a transaction integrity failure in WPForms chunked file uploads, and the CVSS score understates the risk. The vulnerability isn't a validation bypass — it's a cleanup failure. When file chunks are assembled, the complete file is written to disk before validation runs. If validation fails, the file stays on disk. An attacker doesn't need to beat a filter; they just need to trigger validation to fail after the malicious file exists. That's fundamentally different from typical upload vulnerabilities and explains why this is higher-risk than the base score suggests. If you run WPForms, update immediately — this plugin has millions of active installations and the attack vector is unauthenticated. But the update is only half the response. Check your uploads directory (typically /wp-content/uploads/wpforms/) for files that shouldn't be there, particularly those with executable extensions (.php, .phtml, .js) in folders where you only expect images or documents. The exploitation signature isn't a race condition — it's orphaned files that exist after failed upload attempts. The architectural pattern here deserves attention. Any file assembly process that writes to disk before validation completes creates this failure mode, and this isn't novel — it's been documented across WordPress plugins for years. The platform provides `move_uploaded_file()` but nothing for transactional assembly with atomic cleanup on failure. That infrastructure gap means every plugin author reinvents this logic independently, and most get it wrong. Assume other plugins in your stack have similar issues until proven otherwise, especially any that handle large uploads, backups, or media processing. The practical window for defense is narrower than you might expect. WordPress plugin updates are voluntary and many sites don't patch promptly. Attackers will scan for this vulnerability within hours of publication. If you're on an older version and can't update immediately, consider disabling file uploads in WPForms or adding web server-level rules to block executable uploads in the wpforms directory.

Reviewed through automated stages and approved by a human before publication.