CVE-2008-0198

Wp-contactform - CSRF

Title source: rule

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.

References (7)

[Broken Link, Exploit, Third Party Advisory] http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html

[Broken Link, Third Party Advisory] http://securityreason.com/securityalert/3539

[Broken Link, Third Party Advisory] http://securityvulns.ru/Sdocument546.html

[Broken Link, Third Party Advisory] http://securityvulns.ru/Sdocument667.html

[Third Party Advisory] http://websecurity.com.ua/1600/

[Third Party Advisory] http://websecurity.com.ua/1641/

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/485786/100/0/threaded

Scores

EPSS 0.0024

EPSS Percentile 47.0%

Classification

CWE

CWE-352

Status draft

Affected Products (1)

wp-contactform_project/wp-contactform

Timeline

Published Jan 10, 2008

Tracked Since Feb 18, 2026