PT-2026-50647 · WordPress · Magicform

0Xbassia · CVE-2026-9815 · Published 2026-06-18 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MagicForm versions prior to 0.1.4

Description The MagicForm WordPress plugin fails to properly validate file types uploaded via an unauthenticated AJAX action. This occurs when a form's per-field extension allowlist is left empty, enabling unauthenticated attackers to upload PHP files and execute arbitrary code on the server.

Recommendations Update to a version later than 0.1.3.

Exploit

Fix

Related Identifiers

CVE-2026-9815

Affected Products

Magicform

References · 4

• 🔥 https://wpscan.com/vulnerability/043f449f-fc65-4218-83d2-7742e62f2af3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9815 · Security Note
• https://t.me/CVEtracker/57221 · Telegram Post
• https://t.me/cveNotify/170321 · Telegram Post