Vulnerability · Published Oct 16, 2023 · Assigned by WPScan
CVE-2023-4666Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload
Critical 9.8
In plain English
A critical-severity security flaw in Form Maker by 10Web from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)3.8%top 10.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Form Maker by 10Web | 0 – before 1.15.20 |
References
- https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be exploit, vdb-entry, technical-description