Wpmu Dev Your All In One Wordpress Platform
Monthly
Arbitrary file download via path traversal in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and including 1.55.0.2, letting remote unauthenticated attackers read files outside the intended directory (CVSS 7.5, confidentiality-only). The Patchstack reference characterizes this as an arbitrary file download flaw, meaning sensitive server files such as wp-config.php could be exfiltrated. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
DOM-based cross-site scripting in the WPMU DEV Forminator WordPress plugin (versions up to and including 1.55.0.1) allows remote attackers to execute arbitrary JavaScript in a victim's browser when the victim interacts with a maliciously crafted link or page element. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope-changing impact but requires user interaction; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Blind SQL injection in WPMU DEV Broken Link Checker WordPress plugin versions ≤2.4.7 allows authenticated high-privilege users to extract database contents and potentially cause limited availability impact. CVSS 7.6 with scope change indicates potential container escape from plugin context. EPSS score of 0.02% (6th percentile) suggests low immediate exploitation likelihood. No public exploit code or CISA KEV listing identified at time of analysis. Patchstack discovery indicates vulnerability likely responsibly disclosed through bug bounty channel.
Forminator through version 1.50.2 contains an authorization bypass that allows unauthenticated attackers to modify data through incorrectly configured access controls. The vulnerability affects WordPress sites using the WPMU DEV Forminator plugin and requires no user interaction to exploit. No patch is currently available for this issue.
Arbitrary file download via path traversal in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and including 1.55.0.2, letting remote unauthenticated attackers read files outside the intended directory (CVSS 7.5, confidentiality-only). The Patchstack reference characterizes this as an arbitrary file download flaw, meaning sensitive server files such as wp-config.php could be exfiltrated. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
DOM-based cross-site scripting in the WPMU DEV Forminator WordPress plugin (versions up to and including 1.55.0.1) allows remote attackers to execute arbitrary JavaScript in a victim's browser when the victim interacts with a maliciously crafted link or page element. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope-changing impact but requires user interaction; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Blind SQL injection in WPMU DEV Broken Link Checker WordPress plugin versions ≤2.4.7 allows authenticated high-privilege users to extract database contents and potentially cause limited availability impact. CVSS 7.6 with scope change indicates potential container escape from plugin context. EPSS score of 0.02% (6th percentile) suggests low immediate exploitation likelihood. No public exploit code or CISA KEV listing identified at time of analysis. Patchstack discovery indicates vulnerability likely responsibly disclosed through bug bounty channel.
Forminator through version 1.50.2 contains an authorization bypass that allows unauthenticated attackers to modify data through incorrectly configured access controls. The vulnerability affects WordPress sites using the WPMU DEV Forminator plugin and requires no user interaction to exploit. No patch is currently available for this issue.