PT-2023-30146 · 10Web · The Form Maker

Dc11 · Publicado 2023-10-16 · Atualizado 2025-09-24 · CVE-2023-4666

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Form Maker by 10Web WordPress plugin versions prior to 1.15.20

Description The issue allows unauthenticated users to create arbitrary files on the server from user input due to a lack of signature validation, potentially leading to remote code execution (RCE).

Recommendations For versions prior to 1.15.20, update to version 1.15.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's file creation functionality until a patch is applied.

Exploit

Correção

Identificadores relacionados

CVE-2023-4666

Produtos afetados

The Form Maker

Referências · 7

• 🔥 https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be · Exploit
• https://twitter.com/VulmonFeeds/status/1714053500664009036 · Publicação no Twitter
• https://twitter.com/pdnuclei_bot/status/1970941340973236728 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1714006531732128076 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-4666 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-4666 · Nota de Segurança
• https://t.me/cibsecurity/72347 · Publicação no Telegram