Critical · 9.8 CVE-2023-28409 EUVD-2023-32105GHSA-3hh7-86f2-m64w

Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated …

Published May 23, 2023 · Updated Jan 31, 2025 · Assigned by jpcert

Vendor: Monkey Wrench Product: MW WP Form

Description

Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated attacker to upload an arbitrary file.

Affected products

Vendor	Product	Affected	Fixed
Monkey Wrench	MW WP Form	versions v4.4.2 and earlier	—

References

https://plugins.2inc.org/mw-wp-form/blog/2023/05/08/752/
https://jvn.jp/en/jp/JVN01093915/