CVE-2023-4596
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function.
Risk Assessment
This allows unauthenticated attackers to upload arbitrary files on the affected site's server, potentially leading to remote code execution.
Recommendation
It is recommended to update the Forminator plugin to the latest version to mitigate this vulnerability and to monitor the server for unauthorized files.
Original NVD description (English source)
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.