Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

Vulnerability

The Form Maker by 10Web WordPress plugin versions before 1.15.20 fails to validate signatures when creating them from user input on the server. This allows unauthenticated users to upload arbitrary files, bypassing intended access controls [1].

Exploitation

An unauthenticated attacker can send crafted requests to the vulnerable signature creation endpoint without needing any authentication or prior access. By providing a malicious signature, the attacker can upload arbitrary files (e.g., a PHP web shell) to the server [1].

Impact

Successful exploitation allows an attacker to execute arbitrary PHP code on the server, leading to remote code execution (RCE) with the privileges of the web server. This can result in full site compromise, including data theft, defacement, or further lateral movement [1].

Mitigation

The vulnerability is fixed in Form Maker version 1.15.20. All users should update to this version or later. No workarounds are available from the vendor. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog [1].