JVN#50132400
Multiple vulnerabilities in WordPress Plugin "Forminator"

Overview

WordPress Plugin "Forminator" provided by WPMU DEV contains multiple vulnerabilities.

Products Affected

CVE-2024-28890

• Forminator versions prior to 1.29.0

• Forminator versions prior to 1.29.3

• Forminator versions prior to 1.15.4

Description

WordPress Plugin "Forminator" provided by WPMU DEV contains multiple vulnerabilities listed below.

• Unrestricted upload of file with dangerous type (CWE-434)
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2024-28890
• SQL injection (CWE-89)
  • CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2
  • CVE-2024-31077
• Cross-site scripting (CWE-79)
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score 6.1
  • CVE-2024-31857

Impact

• A remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin and cause a denial-of-service (DoS) condition (CVE-2024-28890)
• An administrative user may obtain and alter any information in the database and cause a denial-of-service (DoS) condition (CVE-2024-31077)
• A remote attacker may obtain user information etc. and alter the page contents on the user's web browser (CVE-2024-31857)

Solution

Update the plugin
Update the plugin according to the information provided by the developer.