CVE-2023-4596 Scanner
Detects 'Arbitrary File Upload' vulnerability in WordPress Plugin Forminator affects v. up to and including 1.24.6
Used 3.3k times · 5.9k assets checked · domain, ipv4, subdomain
CVE
CVE-2023-4596
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
forminator forms – contact form, payment form & custom form builder
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: forminator forms – contact form, payment form & custom form builder
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →