CVE-2023-28409

Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated attacker to upload an arbitrary file.

Score

CVSS 3.1 9.8 Critical

Status

Modified - vultures@jpcert.or.jp

Published

2023-05-23

Last modified

2025-01-31

Weaknesses

CWE-434

Affected products

• Mw Wp Form (Monkey Wrench Inc.)
• Mw Wp Form (Mw Wp Form Project)

References

• https://jvn.jp/en/jp/JVN01093915/
• https://plugins.2inc.org/mw-wp-form/blog/2023/05/08/752/