CVE Database /
CVE-2023-28409
CVE · Critical
CVE-2023-28409 — MW WP Form [mw-wp-form] < 4.4.3
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2023-28408, CVE-2023-28409
|
MW WP Form [mw-wp-form] < 4.4.3 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
Critical
9.8
|
< 4.4.3
|
4.4.3 |
2023-05-15 |
—
|
CVE-2023-28408, CVE-2023-28409
The MW WP Form plugin before version 4.4.3 contains an unrestricted file upload vulnerability that allows dangerous file types to be uploaded. This flaw could enable attackers to upload malicious files to the server. The vulnerability was reported by Shuya Ota of Mitsui Bussan Secure Directions, Inc., and coordination occurred between JPCERT/CC and the plugin developer.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings