CVE-2023-4666: Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload
Published Oct 16, 2023
·Updated
The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
Affected Software
1 affected component
10web Form Maker Wordpress<1.15.20
Event History
Oct 16, 2023
CVE Published
via MITRE·07:39 PM
Data Sourced
via MITRE·07:39 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-4666.
2
What is the severity of CVE-2023-4666?
CVE-2023-4666 has a severity level of critical with a score of 9.8.
3
What does the Form Maker by 10Web WordPress plugin vulnerability allow?
The vulnerability in the Form Maker plugin allows unauthenticated users to create arbitrary files and potentially lead to remote code execution (RCE).
4
Which versions of the Form Maker by 10Web WordPress plugin are affected by CVE-2023-4666?
Versions up to and excluding 1.15.20 of the Form Maker plugin for WordPress are affected by CVE-2023-4666.
5
Is there a fix for CVE-2023-4666?
Yes, updating the Form Maker plugin to version 1.15.20 or newer will fix the vulnerability.