Loading story…
HeyForm patched a high-severity vulnerability, tracked as CVE-2026-63429, that allowed unauthenticated users to upload arbitrary files through the POST /api/upload endpoint and receive a permanent public URL hosted on the HeyForm domain. The flaw affected versions prior to 3.0.0-rc.9 and stemmed from missing authentication, session validation, form-context checks, and openToken enforcement, enabling remote abuse by any internet user to store files up to 10 MB without authorization. The issue was classified under CWE-306 and CWE-434 and assigned a CVSS 8.6 severity rating.
The fix landed in HeyForm’s security hardening update, which restricted anonymous uploads to valid form contexts, enforced token validation, limited uploads to approved form fields, and added cleanup for unauthorized files. The same update also tightened related security controls by improving sanitization of obfuscated javascript:, vbscript:, and data: URLs, reducing HTML and CSS injection risks, strengthening outbound request protections against SSRF and DNS rebinding, and binding open tokens to form IDs to prevent unauthorized field injection. Users were advised to upgrade to 3.0.0-rc.9 or later.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-63429 was disclosed as a high-severity vulnerability affecting HeyForm versions prior to 3.0.0-rc.9, where an unauthenticated /api/upload endpoint allowed arbitrary file uploads and returned permanent public URLs. The disclosure states the issue was patched in version 3.0.0-rc.9 and advises users to upgrade.
A HeyForm GitHub commit titled "fix: harden form security surfaces" introduced protections including restricting anonymous uploads to valid form context with token validation, tightening submission handling, improving sanitization, and adding SSRF/DNS rebinding defenses. The commit also added and updated tests covering the new security checks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the **Forminator Forms** WordPress plugin exposed roughly **600,000 sites** to unauthenticated arbitrary file upload and potential remote code execution. Tracked as `CVE-2026-15748`, the flaw affects all versions through **1.56.1** and can be exploited when a form includes both a **File Upload** field and a **Select** field. Researchers said attackers could forge upload metadata and bypass file-type checks in the plugin's `handle_file_upload()` logic to upload malicious **PHP** files. In default configurations, uploaded files are usually stored in a directory protected by `.htaccess`, which can block direct execution, but sites using a custom upload storage root may lack that safeguard and be fully compromised. The vendor patched the issue in **Forminator Forms 1.56.2**. Separate reporting also highlighted another critical WordPress plugin issue: **User Profile Builder** `CVE-2026-15826`, an authentication bypass fixed in **3.16.5** that could let unauthenticated attackers log in as **user ID 1** when **Automatically Log In** is enabled.
Aug 25, 2026
A critical vulnerability tracked as **CVE-2026-14894** affects the WordPress plugin **Super Forms – Drag & Drop Form Builder** in versions **up to and including 6.3.313**, allowing unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution. The flaw stems from missing file-type validation in the plugin's `submit_form` function and the absence of a capability check on a `nopriv` AJAX handler; the required nonce can also be trivially obtained through the `super_create_nonce` `nopriv` AJAX action. The issue is classified as **CWE-434** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. The maintainer released **Super Forms 6.3.314** to address the issue by hardening file-upload handling and preventing unauthorized file writes. The patch restricts PDF generation behavior, sanitizes filenames, verifies that uploaded content begins with a PDF header, and enforces safer path handling within the upload directory, closing an attack path that could be exploited in as few as two unauthenticated HTTP requests.
Jul 10, 2026
A critical vulnerability in the **Elementor Pro** WordPress plugin, tracked as `CVE-2026-32475`, allows unauthenticated attackers to upload arbitrary files and achieve remote code execution on affected sites. The flaw impacts versions **4.2.1 and earlier** and exists in the Forms module’s **File Upload** field, where file validation and file movement are handled inconsistently across separate loops. By crafting a multipart request with two file parts for the same field, an attacker can bypass extension checks and place a PHP file in the publicly accessible `wp-content/uploads/elementor/forms/` directory. The issue can be exploited when a published Elementor page includes a Form widget with a File Upload field, a configuration described as common because the field is not required by default. Researcher **Tin Pham (TF1T)** reported the bug through the Patchstack Bug Bounty Program, and Elementor addressed it in **version 4.2.2** by aligning the loop logic and adding an extension check in the file-move path. Defenders were warned that upgrading does not remove files already uploaded through exploitation and should inspect the Elementor forms upload directory for unexpected PHP files.
Aug 26, 2026