Key points
- The vulnerability exists in SimpleForm versions up to and including 3.10.0.
- Unauthenticated users can create new accounts with full administrator privileges.
- The flaw stems from missing capability checks and a flawed exclusion list.
An unauthenticated attacker can create a WordPress administrator account by exploiting a privilege escalation flaw in the SimpleForm plugin. This remote access vector requires no prior credentials, allowing any visitor to the site to gain full control over the WordPress installation through a single malicious request.
The National Vulnerability Database rates CVE-2026-104748 as critical with a CVSS score of 9.8. The issue arises because the plugin’s registration AJAX action lacks capability checks for role assignment. Furthermore, the function handling custom field metadata uses an exclusion list that fails to block the `wp_capabilities` parameter, enabling role manipulation during account creation.
Technical context
The endpoint required for this attack is `wp_ajax_nopriv_simpleform_wp_register`. While it demands a security nonce, this token is publicly emitted into the `front_end_data` JavaScript object on every front-end page. This exposure makes the nonce trivially obtainable for any unauthenticated visitor before they submit the malicious request containing the administrator capability flag.
Who is affected
All versions of the SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin up to and including 3.10.0 are affected. Developed by wpazleen, the plugin is widely used for creating forms. Security teams must verify their installed version against this list, as no newer patched version is mentioned in the source material confirming a fix.
What happens next
Organisations should audit their WordPress installations for the SimpleForm plugin. If any version up to 3.10.0 is present, teams should assess the risk of unauthenticated admin creation. Since no patch is confirmed in the source material, consider disabling the plugin or restricting access to registration endpoints until a vendor update is available.
Why this attack works
This scenario illustrates a failure in input validation and privilege enforcement. Attackers exploit endpoints that accept user-controlled data without verifying the sender’s authority. Security teams usually monitor for unexpected account creations with elevated privileges. Check whether registration forms allow arbitrary metadata injection, as this often indicates a weak filter. Ensure that sensitive role assignments are strictly server-side and never driven by client-side form fields.
What to do and how to stay safe: SimpleForm
- Verify the version of the SimpleForm plugin and check if it is 3.10.0 or older.
- Monitor user creation logs for new accounts with administrator roles created without prior approval.
- Review server access logs for requests to the `wp_ajax_nopriv_simpleform_wp_register` endpoint.
- Once the vendor provides an update, apply it immediately to mitigate the privilege escalation risk.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this SimpleForm vulnerability?
The National Vulnerability Database rates CVE-2026-104748 as critical with a CVSS score of 9.8.
Which versions of SimpleForm are affected?
All versions of the plugin up to and including 3.10.0 are vulnerable to this privilege escalation flaw.
Does a patch exist for this issue?
The source material does not confirm that a patch or updated version has been released to fix this vulnerability.
