CVE-2026-56058: WordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability affects the WordPress Quform plugin at version 2.23.0 and earlier. The flaw is reachable over the network and requires only a low-privilege account (subscriber level), with no victim interaction needed, allowing an attacker to upload and execute arbitrary files on the server. Successful exploitation gives an attacker full read, write, and availability control over the affected system, including the ability to run remote code. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  Any low-privilege account (subscriber level or equivalent) is sufficient; no administrator credentials are needed.

• Victim interactionNot required

  The attacker does not need to trick or involve any other user to complete the exploit.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race conditions, special memory layout, or environmental factors are required.

Blast Radius

• Attacker uploads and executes arbitrary server-side code, achieving remote code execution on the host running WordPress.
• All stored site content, user records, and credentials held in the database become readable to the attacker.
• Attacker can modify or delete any file or database row accessible to the web server process.
• The attacker can crash or render unavailable the WordPress application and any services sharing the same host.