CVE-2026-104748: CWE-269 Improper Privilege Management in wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications

CVE-2026-104748 is a critical privilege escalation vulnerability in the SimpleForm WordPress plugin (versions up to and including 3.10.0). The vulnerability stems from the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability checks for role assignment, combined with the `save_custom_fields_to_user_meta()` function excluding `wp_capabilities` from its restrictions. Additionally, `get_form_settings()` returns a hard-coded defaults array that enables meta writing regardless of the provided `form_id`. Because the nonce required to submit the AJAX request is publicly available in the front-end JavaScript object, unauthenticated attackers can supply `wp_capabilities[administrator]=1` along with registration data to create new Administrator-level accounts without authorization.

Successful exploitation results in unauthenticated attackers gaining Administrator-level access to the affected WordPress site. This grants full control over the site, including the ability to modify content, install plugins, and compromise site integrity and confidentiality. The CVSS 3.1 base score is 9.8 (critical), reflecting the high impact on confidentiality, integrity, and availability with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoint if possible or disable the plugin. Monitor vendor channels for updates and apply patches promptly once released. Avoid exposing sensitive nonces publicly in front-end scripts to reduce attack surface.