by Kastro
Paper/Archive/CVE-2023-4666

CVE-2023-4666

Unknown Form Maker by 10Web — Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

EPSS 4%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 90.0.900 × 2018.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE

Affected

ProductAffectedFixed inSource
Form Maker by 10Web< 1.15.201.15.20CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be