CVE-2026-104748Critical· 9.8▾ AbyssalPoC availableThe SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_w…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
2 GitHub repos
0.6% → 0.8%
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the wp_ajax_nopriv_simpleform_wp_register AJAX action lacking any capability check for role assignment and the save_custom_fields_to_user_meta() function using an exclusion list that omits wp_capabilities, combined with get_form_settings() returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied form_id. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying wp_capabilities[administrator]=1 alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the front_end_data JavaScript object on every front-end page via wp_enqueue_scripts, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-20021Critical· 9.8A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
CVE-2026-110268Medium· 4.9Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
CVE-2026-104745High· 8.1The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0
CVE-2023-26604High· 7.8systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed
CVE-2026-104764High· 7.2The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input
CVE-2026-109143Medium· 5.4A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0