CVE-2023-28409

—

CVSS 3.1

9.8 critical

EPSS

1%p67

Published

May 23, 2023 (May 23, 2023)

Modified

Jun 17, 2026

Description

Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated attacker to upload an arbitrary file.

Vendors: mw wp form project
Products: mw wp form
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.