Piotnet Forms Plugin < 1.0.29 - Unauthenticated Arbitrary File Upload

2024-01-0300:00:00

wpscan.com

vulnerable plugin

arbitrary file uploads

missing file type validation

unauthenticated attackers

remote code execution

security vulnerability

9.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.1%

JSON

Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the ‘piotnetforms_ajax_form_builder’ function, allowing unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.