Read the docs

Mw Wp Form Project

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Mw Wp Form Project records in CISA KEV

No Mw Wp Form Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mw Wp Form 3 records MEDIUM

Records

3 records in Mw Wp Form · all components

TI-2023-12953 CVE-2023-28408 · GHSA-3q42-588x-m4gv

Path traversal in Monkey Wrench Inc. MW WP Form

Priority MEDIUM 52

Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website or cause a denial-of-service (DoS) condition, and obtain sensitive information dep…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01776 Published 2023-05-23 No fix listed CWE-22
TI-2023-05799 CVE-2023-6316 · GHSA-3w6w-q6rh-xhgj

MW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Upload

Priority MEDIUM 52

The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upload' function in versions up to, and including, 5.0.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01436 Published 2024-01-11 No fix listed CWE-434
TI-2023-12954 CVE-2023-28409 · GHSA-3hh7-86f2-m64w

Unrestricted file upload in Monkey Wrench Inc. MW WP Form

Priority MEDIUM 51

Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated attacker to upload an arbitrary file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01226 Published 2023-05-23 No fix listed CWE-434
Open these records in search →