PT-2026-41884 · WordPress · Piotnet Forms

Jude Nwadinobi · Published 2026-05-19 · Updated 2026-05-19 · CVE-2026-4883

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Piotnet Forms versions prior to 2.1.41

Description An arbitrary file upload issue exists due to missing file type validation within the piotnetforms ajax form builder() function. The software employs an incomplete extension blacklist that blocks only php, phpt, php5, php7, and exe extensions, while permitting dangerous extensions such as .phar or .phtml. This allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution. This issue is only exploitable if a file field has been added to the form.

Recommendations Update to a version later than 2.1.40. As a temporary workaround, avoid adding file fields to forms until the update is applied.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-4883

Affected Products

Piotnet Forms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-4883 · Security Note
• https://piotnetforms.com · Note
• https://t.me/cveNotify/164004 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9bd9c9db-d279-4de2-b5e4-ac7d8c919f2a?source=cve · Note