CVE-2023-4666

🗓️ 16 Oct 2023 19:39:11Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 77 Views🌐 WEB

The Form Maker by 10Web WordPress plugin before 1.15.20 allows unauthenticated users to create arbitrary files and lead to RCE

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for CVE-2023-4666	14 Oct 202314:04	–	githubexploit
Circl	CVE-2023-4666	17 Oct 202300:32	–	circl
CNNVD	WordPress plugin Form Maker by 10Web Code Issue Vulnerability	16 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-4666 Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload	16 Oct 202319:39	–	cvelist
EUVD	EUVD-2023-54518	16 Oct 202319:39	–	euvd
Nuclei	Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload	5 Jun 202603:02	–	nuclei
NVD	CVE-2023-4666	16 Oct 202320:15	–	nvd
Prion	Input validation	16 Oct 202320:15	–	prion
Positive Technologies	PT-2023-30146	16 Oct 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-4666	9 Jan 202612:32	–	redhatcve

NVD

Vulners

Node

10web form_makerRange<1.15.20wordpress

[
  {
    "vendor": "Unknown",
    "product": "Form Maker by 10Web",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.15.20"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be

Parameter	Position	Path	Description	CWE
signature-file-wdform_<10-digit-number>	path	/wp-content/uploads/form-maker/signatures/signature-<10-digit-number>.php	Unauthenticated user can create a PHP file via the signature input, leading to remote code execution when the file is accessed.

23 Apr 2025 17:16Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.75684

SSVC