CVE-2023-4666criticalobserved exploitation

CVE-2023-4666: critical vulnerability in Form Maker by 10Web

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor Form Maker by 10Web

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 3.8%
from disclosure to weapon
Published on NVDOct 16
VulnCheckSep 7
The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Form Maker by 10Web
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Form Maker by 10Web

In the same product, most dangerous first.

CVE-2024-6130MEDIUMForm Maker by 10Web < 1.15.26 - Admin+ Stored XSSEPSS 0.4%CVE-2024-10562LOWForm Maker by 10Web < 1.15.31 - Admin+ Stored XSSEPSS 0.4%CVE-2026-16977HIGHForm Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_nameEPSS 0.4%CVE-2024-13605MEDIUMForm Maker by 10Web < 1.15.33 - Admin+ Stored XSSEPSS 0.4%CVE-2024-13053MEDIUMForm Maker by 10Web < 1.15.33 - Admin+ Stored XSS via Theme TitleEPSS 0.3%CVE-2024-10560LOWForm Maker by 10Web < 1.15.30 - Admin+ Stored XSSEPSS 0.3%