CVE-2026-118235 — Arbitrary file upload in the SimpleForm WordPress plugin

The SimpleForm WordPress plugin is vulnerable to arbitrary file upload in all versions up to and including 3.10.2. Unauthenticated attackers may upload potentially executable files, which could make remote code execution possible.