CVE-2026-4883

The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all versions up to, and including, 2.1.40. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form.

• CWE-434

• https://piotnetforms.com
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd9c9db-d279-4de2-b5e4-ac7d8c919f2a?source=cve

Published

May 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48822Shaarli is a personal bookmarking service. Versions 0.16.1 a…5.8
• CVE-2026-48823Shaarli is a personal bookmarking service. Versions 0.16.1 a…4.8
• CVE-2026-48824Mailpit is an email testing tool and API for developers. Pri…5.3
• CVE-2026-48827Path traversal vulnerability in Apache MINA SSHD bundle sshd…7.1
• CVE-2026-48828The Bulk Variables API in Apache Airflow called the redactor…6.5
• CVE-2026-48829In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dere…7.5
• CVE-2026-48831Wine ships a .desktop file that registers itself as a MIME h…7.3
• CVE-2026-48832action/cookie.php in ecrire in SPIP before 4.4.15 is prone t…3.5
• CVE-2026-48834Improper Handling of Length Parameter Inconsistency vulnerab…7.5
• CVE-2026-48835Unauthenticated Broken Access Control in Contact Form by WPF…7.5
• CVE-2026-48836Unauthenticated Remote Code Execution (RCE) in Easy Invoice …10
• CVE-2026-48837Improper Neutralization of Special Elements used in an SQL C…8.5