Critical vulnerabilities
2 critical vulnerabilities in the SimpleForm WordPress plugin and the Acadlix LMS WordPress plugin
2 vulnerabilities rated critical (CVSS 9.0 or higher) found on 31 October 2026: Arbitrary file upload in WordPress plugins, Arbitrary file access in WordPress plugins.
- 2 critical
Arbitrary file upload in SimpleForm · WordPress plugins
CVE-2026-118235
SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data
- Severity
- Critical 9.8
- Published
- 31 Oct 2026
| Software | Affected versions |
|---|---|
| Simple Form (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-118235
Arbitrary file access in Acadlix LMS · WordPress plugins
CVE-2026-103882
Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter
- Severity
- Critical 9.1
- Published
- 31 Oct 2026
| Software | Affected versions |
|---|---|
| Acadlix (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-103882
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.