{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/made-i.t./feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:made_i.t.:forms:3.1:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2024-51791"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Made I.T. Forms (3.1)"],"_cs_severities":["high"],"_cs_tags":["wordpress","rce","file-upload","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Made I.T."],"content_html":"\u003cp\u003eCVE-2024-51791 is an unauthenticated arbitrary file upload vulnerability found in the Made I.T. Forms WordPress plugin. The vulnerability allows an unauthenticated attacker to upload arbitrary PHP files to the server, facilitating remote code execution. A proof-of-concept (PoC) exploit script is publicly available, which automates the process of identifying vulnerable endpoints, uploading a PHP payload, and establishing an interactive shell.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WordPress site running the vulnerable Made I.T. Forms plugin.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with a vulnerable form endpoint (e.g., /form-1/).\u003c/li\u003e\n\u003cli\u003eAttacker submits a maliciously crafted request body containing a PHP payload and the form-id parameter.\u003c/li\u003e\n\u003cli\u003eThe vulnerable plugin fails to sanitize the file upload, saving the PHP shell to the web-accessible directory.\u003c/li\u003e\n\u003cli\u003eAttacker enumerates the upload directories to locate the deployed web shell.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the web shell to execute OS commands or establish a reverse shell.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full compromise of the underlying web server, including unauthorized access to sensitive data, modification of site content, and potential lateral movement within the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all WordPress instances running the Made I.T. Forms plugin.\u003c/li\u003e\n\u003cli\u003eImplement strict ingress filtering to prevent unauthenticated access to form endpoints if immediate patching is not possible.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests to form endpoints containing PHP code or unusual filename extensions.\u003c/li\u003e\n\u003cli\u003eEnsure security patches for the Made I.T. Forms plugin are applied as soon as they are made available by the vendor.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T00:47:01Z","date_published":"2026-10-29T00:47:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-51791-made-it-forms-rce/","summary":"CVE-2024-51791 is an unauthenticated arbitrary file upload vulnerability in the Made I.T. Forms WordPress plugin allowing remote code execution via a PHP web shell.","title":"Made I.T. Forms: Unauthenticated Remote Code Execution (CVE-2024-51791)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-51791-made-it-forms-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Made I.T.","version":"https://jsonfeed.org/version/1.1"}