Arbitrary File Upload Vulnerability in Piotnet Forms Plugin for WordPress
CVE-2023-6220

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
Piotnet Forms
Vendor
CVE Published:
11 January 2024

Summary

The Piotnet Forms plugin for WordPress has a vulnerability that stems from inadequate validation of file types in the 'piotnetforms_ajax_form_builder' function, affecting all versions up to and including 1.0.26. This flaw permits unauthenticated attackers to exploit the server by uploading arbitrary files, potentially resulting in remote code execution on the target website. Web administrators using this plugin should take immediate action to patch the vulnerability and safeguard their sites from possible malicious activities.

Affected Version(s)

Piotnet Forms * <= 1.0.26

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/piotnetforms/t...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

István Márton
.