CVE-2023-4666: 10web Form Maker

Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days.

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE

Affected products

• 10web Form Maker: before 1.15.20 (fixed in 1.15.20)

Published 2023-10-16. Last modified 2026-06-17.