SimpleForm Plugin Flaw Lets Attackers Create Admin Accounts With No Login (CVE-2026-104748)
A serious new security flaw in a popular WordPress form plugin has put thousands of websites on notice. The SimpleForm vulnerability, tracked as CVE-2026-104748, allows an attacker to create a new WordPress account with full Administrator privileges without ever logging in. Disclosed on October 14, 2026 by WPDeeply, based on threat intelligence from Wordfence, the issue carries a CVSS severity score of 9.8 out of 10, placing it firmly in the Critical category. That rating reflects a worst-case combination: no authentication required, remote execution, and total loss of control over the affected site.
The plugin in question is SimpleForm — Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications, plugin slug simple-form. It is a feature-rich form builder that also handles quizzes, polls, and multi-channel lead notifications, which makes it a natural fit for marketing and lead-generation sites. The catch is that the same registration machinery that powers its front-end user features contained the weakness at the heart of the SimpleForm vulnerability. Every installation running version 3.10.0 or earlier is considered vulnerable. The developer has released version 3.10.1 with a fix, and site owners are being urged to update immediately, before they take any other step.
What Happened: Inside the SimpleForm Vulnerability
At its core, the SimpleForm vulnerability is an unauthenticated privilege escalation flaw that ends with the creation of an Administrator account. In plain terms, the plugin exposes a registration action over AJAX — an action identified as simpleform_wp_register — that is reachable by visitors who have no account at all. When a request is made to that handler, the plugin accepts user metadata supplied with the request. The problem is that the code responsible for filtering which fields a visitor may set does not adequately protect WordPress capability fields.
To understand why that matters, it helps to know how WordPress records what a user is allowed to do. WordPress stores user capabilities under a metadata key called wp_capabilities. That key is security-critical: it is what determines whether an account is an ordinary subscriber, an editor, or an administrator with complete control of the site. Any registration path that lets an outsider write to that key has effectively handed that outsider the keys to the site. The SimpleForm vulnerability exists precisely because the plugin’s exclusion logic does not block the wp_capabilities key. A request can therefore include capability data, and the plugin will accept it.
The second half of the problem is what makes the SimpleForm vulnerability exploitable by anyone, not just someone with a foothold. WordPress AJAX actions that perform sensitive operations are normally guarded by a nonce — a short-lived token that verifies the request came from a legitimate form on the site. The disclosure explains that the registration nonce used by this plugin is exposed to visitors on front-end pages. That means an unauthenticated attacker can obtain the nonce the same way any ordinary visitor could, attach it to a crafted request, and have that request accepted by the handler. Combined with the unblocked wp_capabilities key, the result is straightforward: the attacker registers a brand-new account and assigns it Administrator capabilities in a single motion.
Security researchers describe this class of flaw as a mass-assignment weakness. Mass assignment occurs when software copies incoming fields into an object or record without checking which fields the caller is actually allowed to set. It is especially dangerous when the affected path is security-sensitive — and a registration path that can create administrator accounts is about as security-sensitive as it gets. The CVE-2026-104748 SimpleForm vulnerability is a textbook case: visitor-supplied metadata flows into a user record, the capability field is not excluded, and the nonce check that should gate the whole operation is effectively public.
Here are the key technical details of the SimpleForm vulnerability in brief:
- Identifier: CVE-2026-104748, severity Critical with a CVSS score of 9.8.
- Affected component: the unauthenticated AJAX registration action
simpleform_wp_registerin the SimpleForm plugin (slugsimple-form). - Root cause: the plugin’s exclusion logic fails to block the
wp_capabilitiesmetadata key, permitting mass assignment of user capabilities during registration. - Authentication requirement: none. The flaw is unauthenticated, and the registration nonce is exposed to visitors on front-end pages.
- Result of exploitation: creation of a new account with Administrator capabilities, giving the attacker full control of the WordPress site.
- Affected versions: 3.10.0 and earlier. The fixed release is 3.10.1.
The disclosure is a reminder of how a single overlooked field filter can undo every other access control on a site. This SimpleForm vulnerability does not require social engineering, a stolen password, or an existing account of any kind. It is reachable over the web by anyone who knows the request format, and its outcome — a working administrator login — is the highest-impact result an unauthenticated flaw can deliver.
Who Is Affected by the SimpleForm Vulnerability
The scope of the SimpleForm vulnerability is defined by version, not by site type. Any WordPress site running the SimpleForm plugin — full name SimpleForm — Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications, plugin slug simple-form — at version 3.10.0 or earlier is vulnerable. Sites already updated to version 3.10.1 have the fix and are not affected by this flaw.
There are no additional preconditions beyond having the vulnerable plugin active. The attacker does not need an existing WordPress account, any role on the site, or any special access. Because the registration handler is exposed to unauthenticated visitors and the nonce is visible on front-end pages, the attack surface is the public internet: any site with the plugin installed and active is reachable by anyone.
The impact of successful exploitation is total. A newly created administrator account has the same powers as the site’s own administrators. According to the disclosure, that includes the ability to install plugins, alter content, add persistence mechanisms, and access stored data. Each of those deserves a moment of attention. Installing plugins means the attacker can upload code that runs on the server — the classic route to deeper compromise. Altering content means defacing pages, inserting spam links, or injecting malicious scripts that then attack the site’s visitors. Adding persistence means the attacker can entrench themselves: planting backdoor admin accounts, malicious cron jobs, or file-level changes that survive a simple plugin update. And accessing stored data means customer records, order histories, contact-form submissions, and any other sensitive information kept in the WordPress database may have been exposed.
Sites that use the plugin’s registration features most heavily — lead capture funnels, quiz sites, and marketing pages that collect user details — have the widest exposure, because their front-end pages are precisely where the exposed nonce can be harvested. But the SimpleForm vulnerability does not depend on any particular configuration: a default installation of an affected version is enough. The practical upshot is simple. If the plugin is present and has not been updated to 3.10.1, the site should be treated as at risk until it is patched and audited. This SimpleForm vulnerability is not the kind of issue where low traffic or obscurity offers protection; automated scanning means vulnerable sites can be found at scale.
Why the SimpleForm Vulnerability Matters
The SimpleForm vulnerability matters because of what it proves about modern WordPress risk. WordPress sites are typically protected by a layered model: strong passwords, two-factor authentication, login attempt limits, and careful user management all assume that the path to an account goes through legitimate registration or an administrator’s invitation. An unauthenticated privilege escalation flaw bypasses every one of those layers in a single step. It does not matter how strong the administrator’s password is if an attacker can simply mint a new administrator account from the public internet.
The CVSS 9.8 score tells the same story in the industry’s shared language. Scores in the 9.0 to 10.0 range are reserved for flaws that are remotely exploitable, require no user interaction, and deliver complete compromise of confidentiality, integrity, and availability. The SimpleForm vulnerability checks all three boxes: it is reachable by unauthenticated remote attackers, it needs no victim to click anything, and a successful attack yields full administrative control with all the downstream consequences — data access, content manipulation, malware deployment, and persistence.
There is also a structural lesson worth absorbing. Form plugins sit at an especially risky intersection. They are installed precisely to accept input from strangers — contact details, quiz answers, poll responses, leads. That means their code routinely handles untrusted data on public pages. When a mass-assignment weakness exists in that kind of code, the distance between a normal visitor and a privileged attacker collapses to a single HTTP request. The SimpleForm vulnerability is a clear illustration of why every field accepted from the front end must be validated against an allowlist, and why capability-related fields should never be writeable through public endpoints.
It is worth noting that this is not an isolated pattern in the WordPress ecosystem. We covered a similar class of high-impact plugin flaw in our reporting on the Backuply SQL injection flaw, which showed how a single plugin weakness could expose hundreds of thousands of sites, and we regularly track WordPress security releases as part of our coverage of core hardening. The common thread is that plugins extend the attack surface of every site that installs them, and popular plugins become high-value targets precisely because one flaw can be reused across countless installations. Keeping plugins updated is not optional maintenance; it is the front line of defense, and the SimpleForm vulnerability is the latest proof.
Finally, the SimpleForm vulnerability matters because administrator account creation is the gift that keeps giving for attackers. Even after a site is patched, an account created before the update remains valid. Attackers know this, and it is why disclosure-to-patch windows are raced: the fix stops new exploitation, but every site must also look backward for signs that someone already got in. That backward look is the difference between patching and recovering, and the next section walks through exactly how to do both.
What to Do Now: 5 Steps to Stop a SimpleForm Vulnerability Takeover
If you run a WordPress site with SimpleForm installed, treat this as urgent. The following steps address the SimpleForm vulnerability in the order that matters: stop the bleeding first, then check whether the damage was already done, then harden the site so it does not happen again.
1. Update SimpleForm to version 3.10.1 immediately.
This is the single most important action. Version 3.10.1 contains the fix for the SimpleForm vulnerability; versions 3.10.0 and earlier do not. Update through the WordPress dashboard (Dashboard, then Updates) or your usual managed-update process, and confirm afterward that the plugin reports version 3.10.1. Do not delay this step while you investigate — patching closes the hole that lets new administrator accounts be created. If you manage many sites, prioritize this update across your entire fleet before doing anything else, because every unpatched installation remains an open door.
2. Audit your Users list for unknown administrators.
Because the SimpleForm vulnerability creates real administrator accounts, patching alone is not enough: an account planted before the update will still work. Go to Users, then All Users in wp-admin, and review every account with the Administrator role. Look for usernames, display names, or email addresses you do not recognize, accounts created recently, and any administrator you did not personally add. Remove or demote anything suspicious — but first note the details (username, email, registration date) in case you need them for an incident report or your hosting provider’s security team. Pay special attention to accounts with generic or random-looking names, which are typical of automated exploitation.
3. Check for recently installed plugins, themes, and unfamiliar files.
An attacker who gained administrator access through the SimpleForm vulnerability may have gone further: uploading malicious plugins, modifying theme files, or dropping standalone scripts into the uploads directory. Review the Plugins and Themes screens for anything you did not install, and check for files with recent modification dates that you cannot account for. If you have a clean backup or a staging copy from before the disclosure window, comparing file lists is the fastest way to spot additions. Anything you cannot explain should be treated as hostile: deactivate it, remove it, and have the site scanned by a security professional. This step is especially important because the disclosure specifically notes that exploited sites may have persistence added — backdoors designed to survive the plugin update itself.
4. Rotate credentials and keys across the site.
Assume that any secret stored on the site may have been read. Change the passwords of all administrator accounts, rotate WordPress salts and security keys in wp-config.php (which forces every session to re-authenticate), and update credentials for connected services: hosting control panels, FTP or SFTP accounts, database passwords, and API keys for email, payment, or notification services the site uses. If the site stores customer or order data, consider what an attacker with database access could have copied, and act accordingly. Credential rotation is cheap insurance against the most common follow-on attack, which is simply logging back in with something harvested during the first intrusion.
5. Restrict or remove unused registration paths and enable logging.
The SimpleForm vulnerability lived in a public registration path, so take this as a prompt to review every way new users can be created on your site. If public registration is not needed, disable it under Settings, then General, by unchecking membership. If the plugin’s own registration features are not in use, disable them or remove the plugin entirely — an unused plugin with a critical flaw is pure risk with no benefit. Finally, turn on activity logging and monitoring: a security plugin that records user creation, privilege changes, and file modifications will make the next incident visible instead of silent. Long term, consider one of our website care plans, which include proactive update management, security monitoring, and regular audits — the kind of routine maintenance that catches issues like the SimpleForm vulnerability before they become emergencies.
6. If you find evidence of compromise, treat it as an incident.
If your audit turns up an unknown administrator, an unfamiliar plugin, or modified files, the site is not merely at risk — it has been compromised. Restore from a known-clean backup made before the compromise window where possible, have a professional clean the site, and review access logs with your host to understand what happened. Notify affected parties if customer data may have been exposed. A patched plugin is necessary but not sufficient for a hacked site; full remediation is the only way to be sure the attacker is truly gone.
SimpleForm Vulnerability: Frequently Asked Questions
What exactly is the SimpleForm vulnerability?
The SimpleForm vulnerability, tracked as CVE-2026-104748, is an unauthenticated privilege escalation flaw in the SimpleForm WordPress plugin (slug simple-form). It lets a remote attacker with no account create a new WordPress user with full Administrator capabilities through the plugin’s simpleform_wp_register AJAX action, because the plugin does not block the security-sensitive wp_capabilities metadata key and exposes the registration nonce to front-end visitors. It is rated Critical with a CVSS score of 9.8.
Which versions are affected by the SimpleForm vulnerability, and how do I fix it?
All versions up to and including 3.10.0 are affected. The fix is in version 3.10.1 — update the plugin immediately through your WordPress dashboard and verify the new version number afterward. After updating, audit your Users list for administrator accounts you did not create, because any account planted before the patch remains active even after the SimpleForm vulnerability itself is fixed.
Do attackers need an account or password to exploit the SimpleForm vulnerability?
No. That is what makes this SimpleForm vulnerability so dangerous. No existing WordPress account is needed, and no password has to be guessed or stolen. The vulnerable registration handler is reachable by unauthenticated visitors, and the nonce that protects it is exposed on front-end pages — so anyone on the internet can attempt the attack.
What can an attacker do with the admin account created through the SimpleForm vulnerability?
Everything a normal administrator can do: install plugins (including malicious ones), alter site content, add persistence such as backdoor accounts or files that survive updates, and access stored data like customer records and form submissions. That is why the response to the SimpleForm vulnerability has two halves — patching to stop new attacks, and auditing to find and remove any foothold an attacker already established.
SimpleForm Vulnerability: Conclusion and Next Steps
The SimpleForm vulnerability is about as serious as a WordPress plugin flaw gets: unauthenticated, remotely exploitable, and ending in full administrator access. Disclosed on October 14, 2026 by WPDeeply from Wordfence threat intelligence, CVE-2026-104748 affects SimpleForm 3.10.0 and earlier and is fixed in 3.10.1. If the plugin is on your site, update now, then audit your users, files, and credentials for signs of prior exploitation — because patching stops the attack but does not remove an intruder who is already inside. Staying ahead of flaws like this one is exactly what ongoing maintenance is for. If you would rather have experts handle it, Qamar Digital Ventures LLC offers website care plans covering proactive updates, security monitoring, and regular audits — visit https://qamardigitalventuresllc.com/ to protect your site before the next critical disclosure lands.
