CVE-2023-6220: Piotnet Forms <= 1.0.28 - Unauthenticated Arbitrary File Upload
The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'piotnetformsajaxformbuilder' function in versions up to, and including, 1.0.28. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6220?
CVE-2023-6220 has a high severity rating due to its potential for unauthorized file uploads.
How do I fix CVE-2023-6220?
To fix CVE-2023-6220, update the Piotnet Forms plugin to version 1.0.27 or later.
Who is affected by CVE-2023-6220?
CVE-2023-6220 affects users of the Piotnet Forms plugin for WordPress versions up to and including 1.0.26.
What kind of attacks can result from CVE-2023-6220?
CVE-2023-6220 can allow unauthenticated attackers to upload arbitrary files, potentially leading to further exploitation.
Is CVE-2023-6220 a remote code execution vulnerability?
CVE-2023-6220 is not a remote code execution vulnerability, but it does permit arbitrary file uploads which can be leveraged for further attacks.