CVE-2026-1056

Critical

Published: 28 January 2026

Published

28 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.1271 95.8th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-1056 is a critical-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-1056 is a critical vulnerability in the Snow Monkey Forms plugin for WordPress, affecting all versions up to and including 12.0.3. It stems from insufficient file path validation in the 'generate_user_dirpath' function, enabling arbitrary file deletion on the server. Rated at CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), the flaw exposes WordPress sites using this plugin to severe risks.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By manipulating file paths, they can delete arbitrary files, such as wp-config.php, potentially leading to remote code execution, complete site compromise, data loss, or denial of service.

Mitigation involves updating to a patched version of the Snow Monkey Forms plugin, as indicated by the referenced changeset 3448278 in the WordPress plugin trac. Security advisories from sources like Wordfence detail the issue and recommend immediate upgrades; review the provided code references in Directory.php, View.php, and snow-monkey-forms.php for the exact flaw locations and fixes.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-4908

Vulnerability details

The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attackers to delete…

arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1070.004 File Deletion Stealth

Adversaries may delete files left behind by the actions of their intrusion activity.

attack.mitre.org →

Why these techniques?

T1190 directly matches exploitation of a public-facing WordPress plugin vulnerability. T1070.004 enabled by arbitrary file deletion via path traversal.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0