CVE-2024-28890: Incsub Forminator

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.

Affected products

• Incsub Forminator: before 1.29.0 (fixed in 1.29.0)

Published 2024-04-23. Last modified 2026-06-17.