CVE-2023-32623

Deeper analysis

CVE-2023-32623 is a directory traversal vulnerability, tracked as CWE-22, that affects the Snow Monkey Forms WordPress plugin at version 5.1.1 and earlier. The flaw permits an attacker to supply crafted path sequences that resolve outside intended directories, resulting in deletion of arbitrary server files. It carries a CVSS 3.1 base score of 9.1 reflecting network attack vector, low complexity, and no required authentication or user interaction.

A remote unauthenticated attacker can send a single HTTP request to the vulnerable endpoint and cause high-impact integrity and availability effects by removing files such as configuration data, uploaded content, or core application components. No credentials or prior access are needed, and the attack does not expose file contents.

Vendor and JVN advisories direct users to upgrade to Snow Monkey Forms 5.1.2, which contains the corrective patch; administrators should apply the update and verify that file-deletion functionality is restricted to expected paths.

EPSS scores have remained low, with a current value of 0.0558 and a peak of 0.0574, indicating limited observed exploitation interest since disclosure.