CVE-2026-104748Published
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-104748 · Microsoft / collected KEV context
cve-program · CVE-2026-104748
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97?source=cve
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L291
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L184
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L32
- https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Assets.php#L265
- https://plugins.svn.wordpress.org/simple-form/trunk/
- https://plugins.trac.wordpress.org/changeset/3726513/simple-form/trunk/app/Integrations/WordPressAuth.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.