CVE-2008-0198

WP-ContactForm <=1.5a CSRF via wpcf_question/success_msg/error_msg Parameters

Title source: llm

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.

References (7)

Core 7

Core References

Broken Link, Third Party Advisory x_refsource_misc

http://securityvulns.ru/Sdocument546.html

Broken Link, Exploit, Third Party Advisory mailing-list x_refsource_fulldisc

http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html

Third Party Advisory x_refsource_misc

http://websecurity.com.ua/1600/

Broken Link, Third Party Advisory x_refsource_misc

http://securityvulns.ru/Sdocument667.html

Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/485786/100/0/threaded

Broken Link, Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/3539

Third Party Advisory x_refsource_misc

http://websecurity.com.ua/1641/

Scores

EPSS 0.0127

EPSS Percentile 66.5%

Details

CWE

CWE-352

Status published

Products (1)

wp-contactform_project/wp-contactform 1.5 alpha

Published Jan 10, 2008

Tracked Since Feb 18, 2026