CVE-2026-109384 - The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload
CVE ID :CVE-2026-109384 Published : Oct. 28, 2026, 7:16 a.m. | 1 hour, 7 minutes ago Description :The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is...