CVE-2023-4666 Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload
Unauthenticated attackers can upload arbitrary files via signature validation flaws, leading to remote code execution on WordPress sites using Form Maker.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4666?
CVE-2023-4666 is a critical vulnerability in Unknown Form Maker by 10Web, published on 16 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
Which versions are affected by CVE-2023-4666?
It affects 1 product.
Products include 10web Form Maker.
How do I fix CVE-2023-4666?
No fix has been published for CVE-2023-4666 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-4666 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4666 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Unknown Form Maker by 10Web
- CVE-2019-10866 SQL injection in n/a
- CVE-2019-11590 Cross-site request forgery in n/a
- CVE-2022-3300 Form Maker by 10Web < 1.15.6 - Admin+ SQLI
- CVE-2024-43220 WordPress Form Maker by 10Web plugin <= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2023-45070 WordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-w72r-ch4p-xqg3.