CVE-2019-11590

HIGH

10Web Form Maker < 1.13.5 - Cross-Site Request Forgery and Local File Inclusion via Admin-Ajax Action Parameter

Title source: llm
STIX 2.1

Description

The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://wordpress.org/plugins/form-maker/#developers
Exploit, Mailing List, Third Party Advisory x_refsource_misc
https://lists.openwall.net/full-disclosure/2019/04/05/11
Exploit, Third Party Advisory x_refsource_misc
http://seclists.org/fulldisclosure/2019/Apr/36

Scores

CVSS v3 8.8
EPSS 0.0117
EPSS Percentile 63.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-22 CWE-829 CWE-352
Status published
Products (1)
10web/form_maker < 1.13.5
Published Apr 29, 2019
Tracked Since Feb 18, 2026