CVE-2022-23180

MEDIUM

Contact Form & Lead Form Elementor Builder < 1.7.4 - Authenticated Missing Authorization

Title source: llm

Description

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings

References (2)

Core 2

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/da87358a-3a72-4cf7-a2af-a266dd9b4290/

Patch patch

https://plugins.trac.wordpress.org/changeset/2670484

Scores

CVSS v3 4.3

EPSS 0.0053

EPSS Percentile 40.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (1)

themehunk/contact_form_\&_lead_form_elementor_builder < 1.7.4

Published Jan 16, 2024

Tracked Since Feb 18, 2026