CVE-2024-4620

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Unknown	ARForms - Premium WordPress Form Builder Plugin	< 6.6
reputeinfosystems	arforms_form_builder	< 6.6

References

https://wpscan.com/vulnerability/dc34dc2d-d5a1-4e28-8507-33f659ead647/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/dc34dc2d-d5a1-4e28-8507-33f659ead647/Exploit, Third Party Advisory

Timeline

Published: Jun 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-462095.4A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitr CVE-2024-46214.8The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which cou CVE-2024-462107.2An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploadin CVE-2024-462124.9An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.CVE-2024-462137.2REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.CVE-2024-462156.5A vulnerability was discovered in KM08-708H-v1.1, There is a buffer overflow in the sub_445BDC() function within the /usr/sbin/goahead progr CVE-2024-46228.3If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default creden CVE-2024-462264.8A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the admin CVE-2024-46236.4The Blogmentor – Blog Layouts for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagination_style’ par CVE-2024-462365.4CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the address parameter in add_members.php and edi CVE-2024-462375.4PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) via the patname, pataddress, and medhis parameters in CVE-2024-462385.9Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /admin/a