CVE-2026-10818 is an arbitrary file upload vulnerability in WPForms Pro plugin for WordPress affecting all versions up to 1.10.1.1. The issue occurs in the ajax_chunk_upload_finalize function where file type validation happens after chunk metadata and file contents are already written to disk. If the validation fails, the assembled file is not deleted, enabling unauthenticated attackers to upload files that may be executable. This flaw can be exploited to achieve remote code execution on the affected system.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, including potentially executable ones, leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to file upload functionality and monitor for suspicious uploads. Avoid using affected versions in production environments if possible.