CVE-2023-4666: 
WordPress vulnerability analysis and mitigation

The Form Maker by 10Web WordPress plugin versions before 1.15.20 contains a critical security vulnerability identified as CVE-2023-4666. The vulnerability was discovered and publicly disclosed on September 19, 2023. This security flaw affects the signature validation mechanism in the plugin, where the system fails to properly validate signatures when creating them on the server from user input (WPScan Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The technical issue stems from improper validation of signatures in the form processing functionality, which can be exploited without requiring authentication (NVD Database).

The vulnerability allows unauthenticated users to create arbitrary files on the server, potentially leading to Remote Code Execution (RCE). An attacker can exploit this flaw to upload malicious PHP files to the server, which could result in complete system compromise (WPScan Advisory).

A proof of concept exists demonstrating how an attacker can exploit this vulnerability. The attack can be executed on any page containing a form with a Signature field, where malicious code can be injected through the web developer console. The uploaded file is stored in the /wp-content/uploads/form-maker/signatures/ directory with a pseudo-random filename. The attacker can either attempt to guess the random part of the filename or wait for an admin to view the submissions list, which triggers the execution of the malicious code (WPScan Advisory).

The vulnerability has been patched in version 1.15.20 of the Form Maker plugin. Website administrators using affected versions should immediately upgrade to version 1.15.20 or later to protect their systems (WPScan Advisory).