CVE-2023-28408

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website or cause a denial-of-service (DoS) condition, and obtain sensitive information depending on settings.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Monkey Wrench Inc.	MW WP Form	versions v4.4.2 and earlier

References

https://jvn.jp/en/jp/JVN01093915/Third Party Advisory
https://plugins.2inc.org/mw-wp-form/blog/2023/05/08/752/Vendor Advisory
https://jvn.jp/en/jp/JVN01093915/Third Party Advisory
https://plugins.2inc.org/mw-wp-form/blog/2023/05/08/752/Vendor Advisory

Timeline

Published: May 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-284099.8Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated a CVE-2023-28417.2The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up CVE-2023-284107.8Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers for linux before kernel versi CVE-2023-284115.5Double free in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via CVE-2023-284125.3When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices ca CVE-2023-284139.8Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensit CVE-2023-284144.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ApexChat plugin <= 1.3.1 versions.CVE-2023-284154.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XootiX Side Cart Woocommerce (Ajax) plugin <= 2.2 versions.CVE-2023-284164.3Missing Authorization vulnerability in Sparkle Themes Chankhe allows Exploiting Incorrectly Configured Access Control Security Levels.This i CVE-2023-284175.4Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Le CVE-2023-284185.4Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Yudlee themes Mediciti Lite theme <= 1.3.0 versions.CVE-2023-284198.8Cross-Site Request Forgery (CSRF) vulnerability in Stranger Studios Force First and Last Name as Display Name plugin <= 1.2 versions.