SimpleForm WordPress Plugin Arbitrary File Upload Vulnerability

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 3.10.2.

The flaw exists in the handle_upload function. Missing server-side file key allowlist and pre-sanitization extension derivation allow a trailing-dot filename to bypass all extension and MIME validation.

• Affects all versions up to and including 3.10.2
• Requires a page embedding the form shortcode
• Unauthenticated attackers can upload executable files
• Can lead to remote code execution

The only access control is a nonce printed into every public form's data-nonce attribute, so any unauthenticated visitor on a page embedding the form shortcode can obtain it.