WordPress SimpleForm Plugin Privilege Escalation via AJAX

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the m

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The SimpleForm – Form Maker plugin contains a critical privilege escalation vulnerability affecting all versions up to 3.10.0. The flaw exists in the `wp_ajax_nopriv_simpleform_wp_register` AJAX action, which lacks proper capability checks and allows unauthenticated attackers to manipulate user role assignments through the `save_custom_fields_to_user_meta()` function. This function uses a flawed exclusion list that fails to protect the `wp_capabilities` parameter, enabling attackers to escalate their privileges to administrator level. With a CVSS score of 9.8, this vulnerability exposes any WordPress site running the affected plugin to immediate takeover, making it a critical threat to website integrity and data security.

Casky's security platform maps this vulnerability to MITRE ATT&CK technique TA0004 (Privilege Escalation) and identifies 224 relevant skills that detect the attack patterns. Practitioners using Casky would observe findings highlighting: (1) detection of unauthenticated AJAX requests to the vulnerable endpoint lacking role validation; (2) suspicious `wp_capabilities` modifications in user metadata that diverge from normal administrative workflows; (3) lateral movement patterns consistent with freshly-escalated accounts accessing sensitive WordPress functions; (4) anomalous capability assignments appearing in audit logs without corresponding legitimate role changes. Claude's extended reasoning capabilities enable Casky to correlate these disparate signals—combining AJAX handler analysis, capability mutation detection, and post-exploitation behavior patterns—to surface this vulnerability before attackers achieve full site compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-104748.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-104748

Casky has 224 skills that investigate the attack patterns behind CVE-2026-104748. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn