CVE-2023-6133: Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-15 · updated 2026-06-17
Weakness: CWE-434

Description

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with administrator-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed.

Affected products

WPMU DEV Forminator: through 1.27.0

References

https://plugins.trac.wordpress.org/browser/forminator/tags/1.27.0/library/fields/upload.php#L356
https://plugins.trac.wordpress.org/browser/forminator/tags/1.27.0/library/fields/upload.php#L372
https://plugins.trac.wordpress.org/changeset/2995007/forminator/trunk/library/helpers/helper-fields.php#file0
https://www.wordfence.com/threat-intel/vulnerabilities/id/13cfa202-ab90-46c0-ab53-00995bfdcaa3?source=cve
https://plugins.trac.wordpress.org/browser/forminator/tags/1.27.0/library/fields/upload.php#L356
https://plugins.trac.wordpress.org/browser/forminator/tags/1.27.0/library/fields/upload.php#L372
https://plugins.trac.wordpress.org/changeset/2995007/forminator/trunk/library/helpers/helper-fields.php#file0
https://www.wordfence.com/threat-intel/vulnerabilities/id/13cfa202-ab90-46c0-ab53-00995bfdcaa3?source=cve

Get alerted when CVE-2023-6133 or the next vulnerability affects your stack