Critical severity · published Aug 30, 2023
CVE-2023-4596
Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload
9.8
CVSS
14.3%
EPSS
No
On KEV
Description
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)14.3% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder · wpmudev
through 1.24.6 · source: vendor
FO
Forminator · Incsub
through 1.24.6 · source: NVD
Affected product
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4596
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4596
Patch
https://plugins.trac.wordpress.org/changeset/2954409/forminator/trunk/library/fields/postdata.php
Exploit
https://www.exploit-db.com/exploits/51664
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd87da6-1f4c-4a15-8ebb-6e0f8ef72513?source=cve
More from Forminator Forms – Contact Form, Payment Form & Custom Form Builder
9.8
CVE-2026-15748
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
9.1
CVE-2026-92229
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
8.8
CVE-2025-6464
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion
8.8
CVE-2025-6463
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion
8.8
CVE-2024-10402
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation