Vulnerability · Published Apr 23, 2024 · Assigned by jpcert
CVE-2024-28890
Medium 5.3
In plain English
A medium-severity unrestricted file upload in Forminator from WPMU DEV. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 46.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WPMU DEV | Forminator | prior to 1.29.0 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L