Description
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with administrator-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Default version status: unaffected
0 to ≤ 1.27.0affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/13cfa202-ab90-46c0-ab53-00995bfdcaa3?source=cve ↗
- https://plugins.trac.wordpress.org/browser/forminator/tags/1.27.0/library/fields/upload.php#L356 ↗
- https://plugins.trac.wordpress.org/browser/forminator/tags/1.27.0/library/fields/upload.php#L372 ↗
- https://plugins.trac.wordpress.org/changeset/2995007/forminator/trunk/library/helpers/helper-fields.php#file0 ↗