Description
The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Form Maker by 10Web | < 1.15.20 | 1.15.20 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload http/cves/2023/CVE-2023-4666.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be exploit vdb-entry technical-description