CVE-2024-28890

2024-04-2304:56:24

jpcert

github.com

forminator plugin

file upload

vulnerability

remote attacker

sensitive information

denial of service

AI Score

6.4

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:wpmudev:broken_link_checker:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "wpmudev",
    "product": "broken_link_checker",
    "versions": [
      {
        "status": "affected",
        "version": "*"
      }
    ],
    "defaultStatus": "unknown"
  }
]