EXPOSURES › CVE-2026-104748
CVE-2026-104748
CRITICALA WordPress plugin allows unauthenticated attackers to escalate privileges to administrator via a missing capability check and exposed nonce.
The SimpleForm WordPress plugin lacks capability checks on its registration endpoint and exposes the required nonce in frontend JavaScript, enabling unauthenticated privilege escalation to administrator. DIB organizations must audit third-party WordPress plugins for similar missing capability checks and exposed nonces, as this directly violates NIST 800-171 requirements for access control and system integrity. Immediate action requires patching the plugin and reviewing all custom or third-party code for similar privilege escalation vectors.
Shame score — A missing capability check combined with an exposed nonce allows unauthenticated attackers to create administrator accounts, representing a severe, avoidable access control failure.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.