CVE-2023-4666

CRITICAL 9.8EPSS 3.3%

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE

CVSS v3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 3.28% chance of exploitation in the next 30 days, 88th percentile
Published: 2023-10-16
Updated: 2025-04-23

Proof-of-concept exploits (2)

https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be
MataKucing-OFC/NemesisTools52★ · 2025-01-08

References

Related