PT-2023-30146 · 10Web · The Form Maker

Dc11 · Published 2023-10-16 · Updated 2025-09-24 · CVE-2023-4666

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Form Maker by 10Web WordPress plugin versions prior to 1.15.20

Description The issue allows unauthenticated users to create arbitrary files on the server from user input due to a lack of signature validation, potentially leading to remote code execution (RCE).

Recommendations For versions prior to 1.15.20, update to version 1.15.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's file creation functionality until a patch is applied.

Exploit

Fix

Related Identifiers

CVE-2023-4666

Affected Products

The Form Maker

References · 7

• 🔥 https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be · Exploit
• https://osv.dev/vulnerability/CVE-2023-4666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4666 · Security Note
• https://twitter.com/VulmonFeeds/status/1714053500664009036 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1970941340973236728 · Twitter Post
• https://twitter.com/CVEnew/status/1714006531732128076 · Twitter Post
• https://t.me/cibsecurity/72347 · Telegram Post