Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal
critical
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easil...
- CVSS:
- 9.8
- Affected:
- up to 12.0.3
- Fixed in:
- 12.0.4
- Disclosed:
- Jan 27, 2026
CVE-2026-1056 on NVD →
Snow Monkey Forms <= 5.1.1 - Directory Traversal via 'view' REST endpiont
medium
The Snow Monkey Forms plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.1.1 via the 'view' REST endpoint. This allows unauthenticated attackers to upload files with randomized names and non-executable extensions to arbitrary folders.
- CVSS:
- 5.3
- Affected:
- up to 5.1.1
- Fixed in:
- 5.1.2
- Disclosed:
- May 8, 2023
CVE-2023-28413 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database