CVE-2023-6133 Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload

What is CVE-2023-6133?

CVE-2023-6133 is a medium-severity vulnerability in wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder, published on 15 Nov 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with administrator-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed.

Weakness: CWE-434

Which versions are affected by CVE-2023-6133?

It affects 1 product.

Products include Incsub Forminator.

How do I fix CVE-2023-6133?

No fix has been published for CVE-2023-6133 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-6133 being exploited?

There is no known exploitation of CVE-2023-6133 in the wild and no public exploit code.

Other vulnerabilities in wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

• CVE-2023-4596 Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload Critical 9.8
• CVE-2025-6463 Path traversal in Forminator Forms – Contact Form, Payment Form & Custom Form Builder High 8.8
• CVE-2025-6464 Deserialization in Forminator Forms – Contact Form, Payment Form & Custom Form Builder High 7.5
• CVE-2024-7389 Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure High 7.5
• CVE-2024-31077 SQL injection in Forminator High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9w33-c6rh-4qfg.