CVE-2026-9815

Medium · 6.5

CVSS

6.5

EPSS

0.4%

Published

Jun 18, 2026

CISA due date

—

The record

The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.

Affected packages

Ecosystem	Package	Introduced	Fixed