Cyber Posture

CVE-2026-1056

Critical

Published: 28 January 2026

Published
28 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0033 55.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attackers to delete…

more

arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of the path validation flaw in the Snow Monkey Forms plugin to eliminate arbitrary file deletion capability.

SI-10 Information Input Validation good match
prevent

Requires robust validation of file paths in inputs to the generate_user_dirpath function, directly countering the path traversal vulnerability.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Facilitates identification of the CVE-2026-1056 vulnerability in WordPress plugins through regular scanning, enabling proactive patching.

Security SummaryAI

CVE-2026-1056 is a critical vulnerability in the Snow Monkey Forms plugin for WordPress, affecting all versions up to and including 12.0.3. It stems from insufficient file path validation in the 'generate_user_dirpath' function, enabling arbitrary file deletion on the server. Rated at CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), the flaw exposes WordPress sites using this plugin to severe risks.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By manipulating file paths, they can delete arbitrary files, such as wp-config.php, potentially leading to remote code execution, complete site compromise, data loss, or denial of service.

Mitigation involves updating to a patched version of the Snow Monkey Forms plugin, as indicated by the referenced changeset 3448278 in the WordPress plugin trac. Security advisories from sources like Wordfence detail the issue and recommend immediate upgrades; review the provided code references in Directory.php, View.php, and snow-monkey-forms.php for the exact flaw locations and fixes.

Details

CWE(s)
CWE-22

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
attack.mitre.org →
Why these techniques?

T1190 directly matches exploitation of a public-facing WordPress plugin vulnerability. T1070.004 enabled by arbitrary file deletion via path traversal.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References