{"schemaVersion":1,"id":"CVE-2026-104748","requestedId":"CVE-2026-104748","aliases":[],"status":"published","rawState":"Deferred","rawSeverityStatus":"Deferred","duplicateOf":null,"indexable":true,"title":null,"description":"The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.","dates":{"published":"2026-10-14T07:43:35.763Z","modified":"2026-10-14T07:43:35.763Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"cve.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"cve.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"nvd","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00646,"percentile":0.49779,"severity":"low","asOf":"2026-10-14T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-14T00:00:00.000Z","score":0.00646,"percentile":0.49779}],"last30":[{"date":"2026-10-14T00:00:00.000Z","score":0.00646,"percentile":0.49779}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","evidence":[]},"exploits":[],"exploitCount":0,"exploitSources":[],"weaknesses":[{"id":"CWE-269","name":"Improper Privilege Management","description":"The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/269.html","capec":[{"id":"CAPEC-122","name":"Privilege Abuse","url":"https://capec.mitre.org/data/definitions/122.html"},{"id":"CAPEC-233","name":"Privilege Escalation","url":"https://capec.mitre.org/data/definitions/233.html"},{"id":"CAPEC-58","name":"Restful Privilege Elevation","url":"https://capec.mitre.org/data/definitions/58.html"}],"techniques":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","url":"https://attack.mitre.org/techniques/T1548/","tactics":[{"id":"TA0111","name":"Privilege Escalation"}]}],"countermeasures":[{"id":"D3-AA","name":"Agent Authentication","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-AA/"},{"id":"D3-AEM","name":"Application Exception Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-AEM/"},{"id":"D3-AL","name":"Account Locking","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-AL/"},{"id":"D3-AM","name":"Access Modeling","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AM/"},{"id":"D3-CDP","name":"Change Default Password","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-CDP/"},{"id":"D3-CF","name":"Content Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CF/"},{"id":"D3-CI","name":"Configuration Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-CI/"},{"id":"D3-CM","name":"Content Modification","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CM/"},{"id":"D3-CQ","name":"Content Quarantine","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CQ/"},{"id":"D3-DA","name":"Dynamic Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-DA/"},{"id":"D3-DF","name":"Decoy File","tactic":"Deceive","url":"https://d3fend.mitre.org/technique/d3f:D3-DF/"},{"id":"D3-DI","name":"Data Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-DI/"},{"id":"D3-EAL","name":"Executable Allowlisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EAL/"},{"id":"D3-EDL","name":"Executable Denylisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EDL/"},{"id":"D3-EFA","name":"Emulated File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-EFA/"},{"id":"D3-FA","name":"File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FA/"},{"id":"D3-FE","name":"File Encryption","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-FE/"},{"id":"D3-FEV","name":"File Eviction","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-FEV/"},{"id":"D3-FIM","name":"File Integrity Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FIM/"},{"id":"D3-HBPI","name":"Hardware-based Process Isolation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-HBPI/"},{"id":"D3-LFP","name":"Local File Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-LFP/"},{"id":"D3-NTPM","name":"Network Traffic Policy Mapping","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-NTPM/"},{"id":"D3-OPM","name":"Operational Process Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-OPM/"},{"id":"D3-PSA","name":"Process Spawn Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-PSA/"},{"id":"D3-RC","name":"Restore Configuration","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RC/"},{"id":"D3-RD","name":"Restore Database","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RD/"},{"id":"D3-RF","name":"Restore File","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RF/"},{"id":"D3-RFAM","name":"Remote File Access Mediation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-RFAM/"},{"id":"D3-RUAA","name":"Restore User Account Access","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RUAA/"},{"id":"D3-SCA","name":"System Call Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SCA/"},{"id":"D3-SCF","name":"System Call Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-SCF/"},{"id":"D3-SCP","name":"System Configuration Permissions","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SCP/"},{"id":"D3-SFA","name":"System File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SFA/"},{"id":"D3-UAP","name":"User Account Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-UAP/"},{"id":"D3-ULA","name":"Unlock Account","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-ULA/"}]}],"ttp":{"capecs":[{"id":"CAPEC-122","name":"Privilege Abuse","url":"https://capec.mitre.org/data/definitions/122.html","weaknessIds":["CWE-269"],"techniqueIds":["T1548"]},{"id":"CAPEC-233","name":"Privilege Escalation","url":"https://capec.mitre.org/data/definitions/233.html","weaknessIds":["CWE-269"],"techniqueIds":["T1548"]},{"id":"CAPEC-58","name":"Restful Privilege Elevation","url":"https://capec.mitre.org/data/definitions/58.html","weaknessIds":["CWE-269"],"techniqueIds":[]}],"techniques":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","url":"https://attack.mitre.org/techniques/T1548/","weaknessIds":["CWE-269"],"capecIds":["CAPEC-122","CAPEC-233"],"tactics":[{"id":"TA0111","name":"Privilege Escalation"}],"countermeasures":[{"id":"D3-AA","name":"Agent Authentication","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-AA/"},{"id":"D3-AEM","name":"Application Exception Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-AEM/"},{"id":"D3-AL","name":"Account Locking","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-AL/"},{"id":"D3-AM","name":"Access Modeling","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AM/"},{"id":"D3-CDP","name":"Change Default Password","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-CDP/"},{"id":"D3-CF","name":"Content Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CF/"},{"id":"D3-CI","name":"Configuration Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-CI/"},{"id":"D3-CM","name":"Content Modification","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CM/"},{"id":"D3-CQ","name":"Content Quarantine","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CQ/"},{"id":"D3-DA","name":"Dynamic Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-DA/"},{"id":"D3-DF","name":"Decoy File","tactic":"Deceive","url":"https://d3fend.mitre.org/technique/d3f:D3-DF/"},{"id":"D3-DI","name":"Data Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-DI/"},{"id":"D3-EAL","name":"Executable Allowlisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EAL/"},{"id":"D3-EDL","name":"Executable Denylisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EDL/"},{"id":"D3-EFA","name":"Emulated File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-EFA/"},{"id":"D3-FA","name":"File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FA/"},{"id":"D3-FE","name":"File Encryption","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-FE/"},{"id":"D3-FEV","name":"File Eviction","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-FEV/"},{"id":"D3-FIM","name":"File Integrity Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FIM/"},{"id":"D3-HBPI","name":"Hardware-based Process Isolation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-HBPI/"},{"id":"D3-LFP","name":"Local File Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-LFP/"},{"id":"D3-NTPM","name":"Network Traffic Policy Mapping","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-NTPM/"},{"id":"D3-OPM","name":"Operational Process Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-OPM/"},{"id":"D3-PSA","name":"Process Spawn Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-PSA/"},{"id":"D3-RC","name":"Restore Configuration","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RC/"},{"id":"D3-RD","name":"Restore Database","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RD/"},{"id":"D3-RF","name":"Restore File","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RF/"},{"id":"D3-RFAM","name":"Remote File Access Mediation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-RFAM/"},{"id":"D3-RUAA","name":"Restore User Account Access","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RUAA/"},{"id":"D3-SCA","name":"System Call Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SCA/"},{"id":"D3-SCF","name":"System Call Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-SCF/"},{"id":"D3-SCP","name":"System Configuration Permissions","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SCP/"},{"id":"D3-SFA","name":"System File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SFA/"},{"id":"D3-UAP","name":"User Account Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-UAP/"},{"id":"D3-ULA","name":"Unlock Account","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-ULA/"}]}],"countermeasures":[{"id":"D3-AA","name":"Agent Authentication","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-AA/"},{"id":"D3-AEM","name":"Application Exception Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-AEM/"},{"id":"D3-AL","name":"Account Locking","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-AL/"},{"id":"D3-AM","name":"Access Modeling","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AM/"},{"id":"D3-CDP","name":"Change Default Password","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-CDP/"},{"id":"D3-CF","name":"Content Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CF/"},{"id":"D3-CI","name":"Configuration Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-CI/"},{"id":"D3-CM","name":"Content Modification","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CM/"},{"id":"D3-CQ","name":"Content Quarantine","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CQ/"},{"id":"D3-DA","name":"Dynamic Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-DA/"},{"id":"D3-DF","name":"Decoy File","tactic":"Deceive","url":"https://d3fend.mitre.org/technique/d3f:D3-DF/"},{"id":"D3-DI","name":"Data Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-DI/"},{"id":"D3-EAL","name":"Executable Allowlisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EAL/"},{"id":"D3-EDL","name":"Executable Denylisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EDL/"},{"id":"D3-EFA","name":"Emulated File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-EFA/"},{"id":"D3-FA","name":"File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FA/"},{"id":"D3-FE","name":"File Encryption","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-FE/"},{"id":"D3-FEV","name":"File Eviction","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-FEV/"},{"id":"D3-FIM","name":"File Integrity Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FIM/"},{"id":"D3-HBPI","name":"Hardware-based Process Isolation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-HBPI/"},{"id":"D3-LFP","name":"Local File Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-LFP/"},{"id":"D3-NTPM","name":"Network Traffic Policy Mapping","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-NTPM/"},{"id":"D3-OPM","name":"Operational Process Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-OPM/"},{"id":"D3-PSA","name":"Process Spawn Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-PSA/"},{"id":"D3-RC","name":"Restore Configuration","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RC/"},{"id":"D3-RD","name":"Restore Database","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RD/"},{"id":"D3-RF","name":"Restore File","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RF/"},{"id":"D3-RFAM","name":"Remote File Access Mediation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-RFAM/"},{"id":"D3-RUAA","name":"Restore User Account Access","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RUAA/"},{"id":"D3-SCA","name":"System Call Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SCA/"},{"id":"D3-SCF","name":"System Call Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-SCF/"},{"id":"D3-SCP","name":"System Configuration Permissions","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SCP/"},{"id":"D3-SFA","name":"System File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SFA/"},{"id":"D3-UAP","name":"User Account Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-UAP/"},{"id":"D3-ULA","name":"Unlock Account","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-ULA/"}],"countermeasuresByTactic":[{"tactic":"Harden","items":[{"id":"D3-AA","name":"Agent Authentication","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-AA/"},{"id":"D3-CDP","name":"Change Default Password","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-CDP/"},{"id":"D3-FE","name":"File Encryption","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-FE/"},{"id":"D3-SCP","name":"System Configuration Permissions","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SCP/"}]},{"tactic":"Detect","items":[{"id":"D3-AEM","name":"Application Exception Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-AEM/"},{"id":"D3-DA","name":"Dynamic Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-DA/"},{"id":"D3-EFA","name":"Emulated File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-EFA/"},{"id":"D3-FA","name":"File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FA/"},{"id":"D3-FIM","name":"File Integrity Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FIM/"},{"id":"D3-OPM","name":"Operational Process Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-OPM/"},{"id":"D3-PSA","name":"Process Spawn Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-PSA/"},{"id":"D3-SCA","name":"System Call Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SCA/"},{"id":"D3-SFA","name":"System File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SFA/"}]},{"tactic":"Isolate","items":[{"id":"D3-CF","name":"Content Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CF/"},{"id":"D3-CM","name":"Content Modification","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CM/"},{"id":"D3-CQ","name":"Content Quarantine","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CQ/"},{"id":"D3-EAL","name":"Executable Allowlisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EAL/"},{"id":"D3-EDL","name":"Executable Denylisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EDL/"},{"id":"D3-HBPI","name":"Hardware-based Process Isolation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-HBPI/"},{"id":"D3-LFP","name":"Local File Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-LFP/"},{"id":"D3-RFAM","name":"Remote File Access Mediation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-RFAM/"},{"id":"D3-SCF","name":"System Call Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-SCF/"},{"id":"D3-UAP","name":"User Account Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-UAP/"}]},{"tactic":"Evict","items":[{"id":"D3-AL","name":"Account Locking","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-AL/"},{"id":"D3-FEV","name":"File Eviction","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-FEV/"}]},{"tactic":"Restore","items":[{"id":"D3-RC","name":"Restore Configuration","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RC/"},{"id":"D3-RD","name":"Restore Database","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RD/"},{"id":"D3-RF","name":"Restore File","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RF/"},{"id":"D3-RUAA","name":"Restore User Account Access","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RUAA/"},{"id":"D3-ULA","name":"Unlock Account","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-ULA/"}]},{"tactic":"Deceive","items":[{"id":"D3-DF","name":"Decoy File","tactic":"Deceive","url":"https://d3fend.mitre.org/technique/d3f:D3-DF/"}]},{"tactic":"Model","items":[{"id":"D3-AM","name":"Access Modeling","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AM/"},{"id":"D3-CI","name":"Configuration Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-CI/"},{"id":"D3-DI","name":"Data Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-DI/"},{"id":"D3-NTPM","name":"Network Traffic Policy Mapping","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-NTPM/"}]}]},"affected":[{"vendor":"wordpress","product":"simple-form","name":"SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications","label":"simple-form","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"source":null,"versions":[{"text":"≤ 3.10.0 (fixed in 3.10.1)","noFixRecorded":false,"fixedIn":"3.10.1"}],"versionsText":"≤ 3.10.0 (fixed in 3.10.1)","eol":null},{"vendor":"wpazleen","product":"simpleform – form maker to chat apps with quiz, poll and multi lead notifications","name":"SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications","label":"simpleform – form maker to chat apps with quiz, poll and multi lead notifications","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"source":null,"versions":[{"text":"≤ 3.10.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.10.0","eol":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97?source=cve","label":"www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97?source=cve","hostname":"www.wordfence.com","tags":[],"sources":["cve.org","nvd"]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L291","label":"plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php","hostname":"plugins.trac.wordpress.org","tags":[],"sources":["cve.org","nvd"]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L184","label":"plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php","hostname":"plugins.trac.wordpress.org","tags":[],"sources":["cve.org","nvd"]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L32","label":"plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php","hostname":"plugins.trac.wordpress.org","tags":[],"sources":["cve.org","nvd"]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Assets.php#L265","label":"plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Assets.php","hostname":"plugins.trac.wordpress.org","tags":[],"sources":["cve.org","nvd"]},{"url":"https://plugins.svn.wordpress.org/simple-form/trunk/","label":"plugins.svn.wordpress.org/simple-form/trunk/","hostname":"plugins.svn.wordpress.org","tags":[],"sources":["cve.org","nvd"]},{"url":"https://plugins.trac.wordpress.org/changeset/3726513/simple-form/trunk/app/Integrations/WordPressAuth.php","label":"plugins.trac.wordpress.org/changeset/3726513/simple-form/trunk/app/Integrations/WordPressAuth.php","hostname":"plugins.trac.wordpress.org","tags":[],"sources":["cve.org","nvd"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97","label":"www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97","hostname":"www.wordfence.com","tags":["Vendor Advisory"],"sources":["wordfence"]}],"droppedReferenceCount":0,"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-14T07:43:35.763Z","label":"Published","detail":"Vulnerability first disclosed.","source":null}],"risk":{"score":70,"level":"high","profile":"default","profileName":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10},"appliedRules":["high-cvss-alone"]},"warnings":[],"meta":{"dataAsOf":"2026-10-14T22:41:56.767Z","stale":false,"partial":false}}