What’s Vulnerable › Vulnerabilities

CVE-2023-4666: Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-16 · updated 2026-06-17

Description

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE

Affected products

• 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: before 1.15.20 — fixed in 1.15.20

How to fix

Upgrade to a fixed version: 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder 1.15.20. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be
• https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be

Get alerted when CVE-2023-4666 or the next vulnerability affects your stack