CVE-2023-4666

🗓️ 16 Oct 2023 19:39:11Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 97 Views🌐 WEB

The Form Maker by 10Web WordPress plugin before 1.15.20 allows unauthenticated users to create arbitrary files and lead to RCE

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for CVE-2023-4666	14 Oct 202314:04	–	githubexploit
Circl	CVE-2023-4666	17 Oct 202300:32	–	circl
CNNVD	WordPress plugin Form Maker by 10Web Code Issue Vulnerability	16 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-4666 Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload	16 Oct 202319:39	–	cvelist
EUVD	EUVD-2023-54518	16 Oct 202319:39	–	euvd
Nuclei	Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload	21 Jul 202603:59	–	nuclei
NVD	CVE-2023-4666	16 Oct 202320:15	–	nvd
OSV	CVE-2023-4666	16 Oct 202320:15	–	osv
Prion	Input validation	16 Oct 202320:15	–	prion
Positive Technologies	PT-2023-30146	16 Oct 202300:00	–	ptsecurity

NVD

Vulners

Node

10web form_makerRange<1.15.20wordpress

[
  {
    "vendor": "Unknown",
    "product": "Form Maker by 10Web",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.15.20"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be

Parameter	Position	Path	Description	CWE
signature-file-wdform_...	path	/wp-content/uploads/form-maker/signatures/signature-<10 digit number>.php	Unauthenticated creation of PHP signature files via the signature field, enabling RCE when the admin loads the submissions (uploads/signatures/signature-<num>.php executed via image tag).	CWE-434

17 Jun 2026 06:38Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.03283

SSVC