CVE-2023-4596

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

• CWE-434

• https://plugins.trac.wordpress.org/changeset/2954409/forminator/trunk/library/fields/postdata.phpPatch
• https://www.exploit-db.com/exploits/51664Exploit, Third Party Advisory, VDB Entry
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd87da6-1f4c-4a15-8ebb-6e0f8ef72513?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset/2954409/forminator/trunk/library/fields/postdata.phpPatch
• https://www.exploit-db.com/exploits/51664Exploit, Third Party Advisory, VDB Entry
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd87da6-1f4c-4a15-8ebb-6e0f8ef72513?source=cveThird Party Advisory

Published

Aug 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45951lylme_spage v1.7.0 was discovered to contain a SQL injection…9.8
• CVE-2023-45952An arbitrary file upload vulnerability in the component ajax…9.8
• CVE-2023-45955An issue discovered in Nanoleaf Light strip v3.5.10 allows a…7.5
• CVE-2023-45956An issue discovered in Govee LED Strip v3.00.42 allows attac…7.5
• CVE-2023-45957A stored cross-site scripting (XSS) vulnerability in the com…5.4
• CVE-2023-45958Thirty Bees Core v1.4.0 was discovered to contain a reflecte…6.1
• CVE-2023-45960Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2023-45966umputun remark42 version 1.12.1 and before has a Blind Serve…7.5
• CVE-2023-4597The Slimstat Analytics plugin for WordPress is vulnerable to…6.4
• CVE-2023-4598The Slimstat Analytics plugin for WordPress is vulnerable to…6.5
• CVE-2023-45984TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V…9.8
• CVE-2023-45985TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V…7.5