The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
History

Wed, 20 Nov 2024 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2023-12-16T12:29:16.960Z

Updated: 2024-11-20T18:57:10.175Z

Reserved: 2023-12-06T15:23:34.457Z

Link: CVE-2023-6559

cve-icon Vulnrichment

Updated: 2024-08-02T08:35:14.547Z

cve-icon NVD

Status : Modified

Published: 2023-12-16T13:15:07.683

Modified: 2024-11-21T08:44:05.913

Link: CVE-2023-6559

cve-icon Redhat

No data.