Piotnet Forms Plugin for WordPress Critical RCE Vulnerability (CVE-2026-4883)

The Piotnet Forms plugin for WordPress is exposed to a critical arbitrary file upload vulnerability, identified as CVE-2026-4883, according to the National Vulnerability Database. All versions up to, and including, 2.1.40 are affected. The flaw stems from inadequate file type validation within the piotnetforms_ajax_form_builder function, which relies on an incomplete blacklist.

This blacklist only blocks common PHP extensions like .php and .exe, but critically fails to block dangerous extensions such as .phar or .phtml. This oversight enables unauthenticated attackers to upload arbitrary files to an affected server, potentially leading to remote code execution. It’s crucial to note that exploitation is contingent on a file upload field being present in a form.

With a CVSS score of 9.8 (CRITICAL), this vulnerability represents a severe risk for any organization utilizing the Piotnet Forms plugin. The attacker’s calculus here is straightforward: exploit an unauthenticated vector to gain arbitrary file upload, then chain it with other vulnerabilities or misconfigurations to achieve full remote code execution. Defenders must prioritize patching.