CVE-2023-4596: Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the uploadpostimage() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-4596?
CVE-2023-4596 is a vulnerability in the Forminator plugin for WordPress that allows unauthenticated attackers to upload arbitrary files to the server.
How severe is CVE-2023-4596?
CVE-2023-4596 has a severity rating of 9.8, which is considered critical.
What is the affected software version of CVE-2023-4596?
The affected software version of CVE-2023-4596 is Forminator plugin for WordPress up to and including version 1.24.6.
How can I fix CVE-2023-4596?
To fix CVE-2023-4596, update the Forminator plugin for WordPress to a version higher than 1.24.6.
Where can I find more information about CVE-2023-4596?
More information about CVE-2023-4596 can be found at the following references: [Link 1](https://plugins.trac.wordpress.org/changeset/2954409/forminator/trunk/library/fields/postdata.php), [Link 2](https://www.exploit-db.com/exploits/51664), [Link 3](https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd87da6-1f4c-4a15-8ebb-6e0f8ef72513?source=cve).