600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin

The blog post discusses a critical security issue discovered in the Forminator Forms plugin for WordPress. This issue is an unauthenticated arbitrary file upload vulnerability, which allows attackers to upload executable PHP files to vulnerable sites and potentially achieve remote code execution (RCE). The details of the vulnerability are as follows:

Vulnerability Details

Affected Versions

All versions up to and including 1.56.1 of Forminator Forms.

Description

The vulnerability arises from a combination of issues:

• Custom File Type Handling: Users can define custom file types for upload fields, which should be validated against a list of allowed MIME types.
• MIME Type Validation Flaw: The plugin's forminator_allowed_mime_types() function uses a blocklist approach to filter out dangerous extensions like .php. However, it performs exact-key matching rather than regex-based filtering. This allows an attacker to bypass the check by using patterns that match .php files but are not explicitly blocked (e.g., ph(p)).

Exploitation Steps

1. Injecting a Forged Upload Record: An unauthenticated user can inject a forged upload record into the database via a form's select field.
2. **Uploading PHP Files

Read the full article at Wordfence

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.