CVE-2023-28409: 
WordPress vulnerability analysis and mitigation

CVE-2023-28409 affects MW WP Form versions 4.4.2 and earlier, a WordPress plugin provided by Monkey Wrench Inc. The vulnerability is characterized as an unrestricted upload of file with dangerous type, which allows remote unauthenticated attackers to upload arbitrary files (JVN Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited over the network with low attack complexity, requires no privileges or user interaction, and can result in high impacts to confidentiality, integrity, and availability. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD).

When exploited, this vulnerability allows a remote unauthenticated attacker to upload an unintended file to the system. The critical CVSS score indicates that successful exploitation could lead to severe consequences for the affected system (JVN Advisory).

Users are advised to update to MW WP Form version 4.4.3 or later, which contains fixes for this vulnerability (JVN Advisory).