CVE-2024-12427: Mondula Multi Step Form

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23. This makes it possible for unauthenticated attackers to upload limited file types such as images.

Affected products

• Mondula Multi Step Form: before 1.7.24 (fixed in 1.7.24)

Published 2025-01-16. Last modified 2026-06-17.