WordPress IvyForms Plugin Arbitrary File Upload Flaw

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the allowed-extensions sanitizer and deliberate override of WordPress's native MIME and extension defences via a registered wp_check_filetype_and_ext filter. This makes it possible for authenticated attackers, with custom-level access and above, to upload files that may be executable, which makes remote code execution possible. An authenticated attacker with the custom add_edit_forms capability must first configure a File Upload field with a dangerous extension (e.g., php) in the allowed-extensions list; once that form is published, any unauthenticated visitor can trigger the actual file upload via the publicly accessible /wp-json/ivyforms/v1/form/submission/ REST route.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Innovative Form Builder – IvyForms plugin for WordPress contains a critical arbitrary file upload vulnerability (CVE-2026-109384, CVSS 8.8) affecting all versions through 1.5.1. The vulnerability stems from insufficient file type validation in the filterFiletypeAndExt function, which lacks a dangerous-extension denylist and deliberately circumvents WordPress's native MIME type and extension security checks through a malicious wp_check_filetype_and_ext filter. This allows authenticated attackers to upload arbitrary files—potentially including web shells, malware, or other malicious payloads—directly to the server. Organizations running vulnerable versions of IvyForms face immediate risk of server compromise, data exfiltration, and lateral movement within their infrastructure.

Casky.ai maps this threat across MITRE ATT&CK Initial Access (TA0001), Persistence (TA0043), and Execution (TA0002) techniques. Practitioners using Casky's 447 matching security skills with Claude AI's extended reasoning capabilities would identify this attack pattern through detection of: (1) anomalous file upload requests bypassing MIME validation checks, (2) suspicious filter hook registrations that override WordPress security functions, (3) web shells or executable files appearing in upload directories with non-standard extensions, and (4) post-exploitation indicators like reverse shell connections or privilege escalation attempts. Claude's reasoning engine correlates these indicators across the attack chain, helping defenders recognize both the initial upload vector and subsequent persistence or execution behaviors before adversaries establish foothold.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-109384.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-109384

Casky has 447 skills that investigate the attack patterns behind CVE-2026-109384. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn