CVE-2026-10818 describes an arbitrary file upload vulnerability in WPForms Pro for WordPress in all versions up to and including 1.10.1.1. The issue is due to the ajax_chunk_upload_finalize function performing file type validation only after chunk metadata and file contents have been saved to disk. If validation fails, the assembled file is not deleted, enabling unauthenticated attackers to upload files that may be executable. This vulnerability can be exploited to achieve remote code execution. The CVSS 3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, including potentially executable ones, leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable upload functionality and monitor for suspicious file uploads. Avoid exposing the vulnerable endpoint to untrusted users.