JVN#01093915
Multiple vulnerabilities in WordPress Plugin "MW WP Form" and "Snow Monkey Forms"

Overview

WordPress Plugin "MW WP Form" and "Snow Monkey Forms" provided by Monkey Wrench Inc. contain multiple vulnerabilities.

Products Affected

CVE-2023-28408, CVE-2023-28409

• MW WP Form versions v4.4.2 and earlier

• Snow Monkey Forms versions v5.0.6 and earlier

Description

WordPress Plugin "MW WP Form" and "Snow Monkey Forms" provided by Monkey Wrench Inc. contain multiple vulnerabilities listed below.

• Directory traversal (CWE-22) - CVE-2023-28408

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L	Base Score: 7.2
  CVSS v2	AV:N/AC:L/Au:N/C:N/I:P/A:P	Base Score: 6.4

• Unrestricted upload of file with dangerous type (CWE-434) - CVE-2023-28409

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	Base Score: 5.3
  CVSS v2	AV:N/AC:L/Au:N/C:N/I:P/A:N	Base Score: 5.0

• Directory traversal (CWE-22) - CVE-2023-28413

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L	Base Score: 8.3
  CVSS v2	AV:N/AC:L/Au:N/C:P/I:P/A:P	Base Score: 7.5

Impact

• A remote unauthenticated attacker may alter the website or cause a denial-of-service (DoS) condition, and obtain sensitive information depending on settings - CVE-2023-28408
• A remote unauthenticated attacker may upload an unintended file - CVE-2023-28409
• A remote unauthenticated attacker may obtain sensitive information, alter the website, or cause a denial-of-service (DoS) condition - CVE-2023-28413

Solution

Update the plugin
Update the plugin according to the information provided by the developer.