CVE-2023-4666

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Unknown	Form Maker by 10Web	< 1.15.20

References

https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418beExploit, Third Party Advisory
https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418beExploit, Third Party Advisory

Timeline

Published: Oct 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-466605.3Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook t CVE-2023-466619.8Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.CVE-2023-466627.5Sielco PolyEco1000 is vulnerable to an information disclosure vulnerability due to improper access control enforcement. An unauthenticated r CVE-2023-466638.1Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application inte CVE-2023-466649.1Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on CVE-2023-466659.8Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain CVE-2023-466666.5An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Co CVE-2023-466678.1An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log CVE-2023-466689.1If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and CVE-2023-466697.1Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidenti CVE-2023-46674.8The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malic CVE-2023-466716.5An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has releas