Threat Database

Threat Entry Updated 2026-06-22

MagicForm - Security Vulnerability (CVE-2026-9815)

The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.

PLUGIN MagicForm

CVE-2026-9815

MEDIUM CVSS 6.5 2026-06-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Magicform - Broken Access Control (CVE-2025-0939)

The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings.

PLUGIN Magicform

CVE-2025-0939

MEDIUM CVSS 6.3 2025-02-01

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Magicform - Cross-Site Scripting (XSS) (CVE-2022-47592)

Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin

PLUGIN Magicform

CVE-2022-47592

HIGH CVSS 7.1 2023-03-20

Risk Score

Open Full Technical Breakdown