VULNERABILITY INTELLIGENCE

CVE-2023-4596

CVSS score9.8 CRITICAL

EPSS probability14.32%

CISA KEVNot currently listed

Published2023-08-30

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Weakness classification

security@wordfence.com: CWE-434

Primary references

security@wordfence.com — Patch
security@wordfence.com — Exploit, Third Party Advisory, VDB Entry
security@wordfence.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory