CVE-2023-4666

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

CVSS 9.8 CRITICALEPSS 3.3%

Vexday Risk Score

63High priority

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.8EPSS 3.3%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

16 Oct 2023Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Unknown · Form Maker by 10Web

public PoCs found — 1

cve_referencewpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418beunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be