CVE-2024-28890
Forminator <= 1.28.1 - Unauthenticated Arbitrary File Upload
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.
Forminator anterior a 1.29.0 contiene una carga sin restricciones de archivos con una vulnerabilidad de tipo peligroso. Si se explota esta vulnerabilidad, un atacante remoto puede obtener información confidencial accediendo a archivos en el servidor, alterar el sitio que utiliza el complemento y provocar una condición de denegación de servicio (DoS).
The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.28.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-04-12 CVE Reserved
- 2024-04-18 CVE Published
- 2024-04-23 EPSS Updated
- 2024-11-18 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://jvn.jp/en/jp/JVN50132400 | ||
https://wordpress.org/plugins/forminator | ||
https://wpmudev.com |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
WPMU DEV Search vendor "WPMU DEV" | Forminator Search vendor "WPMU DEV" for product "Forminator" | 1.29.0 Search vendor "WPMU DEV" for product "Forminator" and version "1.29.0" | en |
Affected
|