CVE Database /
CVE-2023-28408
CVE · Critical
CVE-2023-28408 — MW WP Form [mw-wp-form] < 4.4.3
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2023-28408, CVE-2023-28409
|
MW WP Form [mw-wp-form] < 4.4.3 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
Critical
9.8
|
< 4.4.3
|
4.4.3 |
2023-05-15 |
—
|
CVE-2023-28408, CVE-2023-28409
The MW WP Form plugin before version 4.4.3 contains multiple security flaws including a directory traversal vulnerability that allows attackers to access files outside intended directories, an unrestricted file upload flaw permitting the upload of dangerous file types, and another directory traversal issue. These vulnerabilities were reported by security researchers and coordinated through JPCERT/CC, and users should update to version 4.4.3 or later to address the issues.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings