Threat Entry Updated 2026-06-22

CVE-2026-9815 - Magicform Plugin

The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.

PLUGIN Magicform

CVE-2026-9815

MEDIUM CVSS 6.5 2026-06-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-21

CVE-2025-0939 - Magicform Plugin

The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings.

PLUGIN Magicform

CVE-2025-0939

MEDIUM CVSS 6.3 2025-02-01

Risk Score

Open Full Technical Breakdown