CSRF Vulnerability in 10Web Form Maker Plugin for WordPress
CVE-2019-11590

8.8HIGH

Key Information:

Vendor: Wordpress
Status: Form Maker
Vendor: CVE Published:; 29 April 2019

What is CVE-2019-11590?

The 10Web Form Maker plugin for WordPress suffers from a Cross-Site Request Forgery (CSRF) vulnerability. This issue allows an attacker to manipulate the wp-admin/admin-ajax.php action parameter, potentially leading to local file inclusion through a directory traversal attack. The vulnerability arises from the lack of sanitization between the $_POST['action'] and $_GET['action'] values, which can be exploited due to this discrepancy. It is crucial for WordPress site administrators to update the plugin to version 1.13.5 or later to mitigate this exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch