WordPress Plugin Vulnerabilities

Forminator < 1.28.0 - Admin+ Arbitrary File Upload

Description

The plugin does not properly blacklist files via the forminator_allowed_mime_types function, which could allow administrator to upload arbitrary file. However, RCE can not be achieved due to htaccess configuration.

Affects Plugins

Plugin icon
forminator
Fixed in 1.28.0

References

CVE
CVE-2023-6133
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/13cfa202-ab90-46c0-ab53-00995bfdcaa3

Miscellaneous

Original Researcher
István Márton
Verified
No
WPVDB ID
7d1ead56-7db2-46c4-97ed-af008e9b5515

Timeline

Publicly Published
2023-11-14 (about 2 years ago)
Added
2023-11-15 (about 2 years ago)
Last Updated
2023-11-15 (about 2 years ago)

Other

Published
Title
Published
2025-07-11
Title
HTML5 Radio Player - WPBakery Page Builder Addon < 2.5.3 - Unauthenticated Arbitrary File Upload
Published
2025-08-15
Title
StoryChief < 1.0.43 - Unauthenticated Arbitrary File Upload
Published
2024-01-09
Title
AI Engine: ChatGPT Chatbot < 1.9.99 - Unauthenticated Arbitrary File Upload
Published
2014-08-01
Title
Vk Gallery 1.1.0 - Shell Upload
Published
2014-08-01
Title
WPtouch 3.x - Insecure Nonce Generation