JVN#50132400: Multiple vulnerabilities in WordPress Plugin "Forminator"

WordPress Plugin “Forminator” provided by WPMU DEV contains multiple vulnerabilities listed below.

Unrestricted upload of file with dangerous type (CWE-434) CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8 CVE-2024-28890SQL injection (CWE-89)CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2 CVE-2024-31077Cross-site scripting (CWE-79) CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score 6.1 CVE-2024-31857

Impact

• A remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin and cause a denial-of-service (DoS) condition (CVE-2024-28890)
• An administrative user may obtain and alter any information in the database and cause a denial-of-service (DoS) condition (CVE-2024-31077)
• A remote attacker may obtain user information etc. and alter the page contents on the user’s web browser (CVE-2024-31857)

Solution

Update the plugin
Update the plugin according to the information provided by the developer.

Products Affected

CVE-2024-28890

• Forminator versions prior to 1.29.0
  CVE-2024-31077

• Forminator versions prior to 1.29.3
  CVE-2024-31857

• Forminator versions prior to 1.15.4