PT-2026-5121 · WordPress · Snow Monkey Forms

Sarawut Poolkhet · Publicado 2026-01-28 · Atualizado 2026-01-30 · CVE-2026-1056

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Snow Monkey Forms versions up to and including 12.0.3

Description The Snow Monkey Forms plugin for WordPress is susceptible to arbitrary file deletion. Insufficient file path validation within the generate user dirpath function allows unauthenticated attackers to delete arbitrary files on the server. Successful deletion of specific files, such as wp-config.php, could lead to remote code execution.

Recommendations Versions prior to and including 12.0.3 should be updated to a newer, fixed version when available. As a temporary workaround, consider restricting access to the generate user dirpath function until a patch is available.

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-1056

Produtos afetados

Snow Monkey Forms

Referências · 12

• https://twitter.com/VulmonFeeds/status/2016632554409849337 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3448278 · Nota
• https://plugins.trac.wordpress.org/browser/snow-monkey-forms/tags/12.0.3/App/Rest/Route/View.php#L189 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1056 · Nota de Segurança
• https://twitter.com/vuln_tracker/status/2017119457337098738 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2016514462413426984 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/37a8642d-07f5-4b1b-8419-e30589089162?source=cve · Nota
• https://twitter.com/DarkWebInformer/status/2016983549568577803 · Publicação no Twitter
• https://twitter.com/akaclandestine/status/2016850529008169320 · Publicação no Twitter
• https://t.me/CVEtracker/43152 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/snow-monkey-forms/tags/12.0.3/snow-monkey-forms.php#L186 · Nota
• https://plugins.trac.wordpress.org/browser/snow-monkey-forms/tags/12.0.3/App/Model/Directory.php#L58 · Nota