{"schema":"vulnpedia.research/1","cve":"CVE-2026-104748","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97?source=cve","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97?source=cve"},{"source":"nvd","sourceId":"CVE-2026-104748","modified":"2026-10-15T17:17:11.513","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97?source=cve"}]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L291","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L291"},{"source":"nvd","sourceId":"CVE-2026-104748","modified":"2026-10-15T17:17:11.513","url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L291"}]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L184","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L184"},{"source":"nvd","sourceId":"CVE-2026-104748","modified":"2026-10-15T17:17:11.513","url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L184"}]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L32","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L32"},{"source":"nvd","sourceId":"CVE-2026-104748","modified":"2026-10-15T17:17:11.513","url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L32"}]},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Assets.php#L265","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Assets.php#L265"},{"source":"nvd","sourceId":"CVE-2026-104748","modified":"2026-10-15T17:17:11.513","url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Assets.php#L265"}]},{"url":"https://plugins.svn.wordpress.org/simple-form/trunk/","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","url":"https://plugins.svn.wordpress.org/simple-form/trunk/"},{"source":"nvd","sourceId":"CVE-2026-104748","modified":"2026-10-15T17:17:11.513","url":"https://plugins.svn.wordpress.org/simple-form/trunk/"}]},{"url":"https://plugins.trac.wordpress.org/changeset/3726513/simple-form/trunk/app/Integrations/WordPressAuth.php","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-14T07:43:35.763Z","url":"https://plugins.trac.wordpress.org/changeset/3726513/simple-form/trunk/app/Integrations/WordPressAuth.php"},{"source":"nvd","sourceId":"CVE-2026-104748","modified":"2026-10-15T17:17:11.513","url":"https://plugins.trac.wordpress.org/changeset/3726513/simple-form/trunk/app/Integrations/WordPressAuth.php"}]},{"source":"euvd","sourceId":"EUVD-2026-100911","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100911","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-100911","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100911"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/joshuavanderpoll/CVE-2026-104748","source":"poc-in-github","sourceId":"CVE-2026-104748","description":"Unauthenticated privilege escalation in SimpleForm WordPress plugin <= 3.10.0. Registers an administrator account without authentication","modified":"2026-10-14T11:00:29Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-104748","url":"https://github.com/joshuavanderpoll/CVE-2026-104748"},{"source":"poc-in-github","sourceId":"CVE-2026-104748","modified":"2026-10-14T11:00:29Z","url":"https://github.com/joshuavanderpoll/CVE-2026-104748"}],"tags":[]},{"url":"https://github.com/MrjHaxcore/CVE-2026-104748","source":"poc-in-github","sourceId":"CVE-2026-104748","description":"CVE-2026-104748 POC","modified":"2026-10-14T16:40:05Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-104748","url":"https://github.com/MrjHaxcore/CVE-2026-104748"},{"source":"poc-in-github","sourceId":"CVE-2026-104748","modified":"2026-10-14T16:40:05Z","url":"https://github.com/MrjHaxcore/CVE-2026-104748"}],"tags":[]}],"cataloguedPoc":[],"vendorStatements":[]}