CyberRota Analysis
AI-GeneratedThe WPForms Pro plugin for WordPress is susceptible to an arbitrary file upload vulnerability, allowing unauthenticated attackers to upload potentially executable files due to improper file type validation. This flaw can lead to remote code execution, posing a significant risk to affected WordPress sites. Website administrators using this plugin should prioritize patching to mitigate the threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.