nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-0667 CVE-2024-0667
MEDIUM
Form-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute
Record summary
CVE-2024-0667 has a selected CVSS score of 5.4 (medium).
Description
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.15.21. This is due to missing or incorrect nonce validation on the 'execute' function. This makes it possible for unauthenticated attackers to execute arbitrary methods in the 'BoosterController' class via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 27, 2024 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form BuilderBrowse 10web / Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form BuilderDefault status: unaffected | CVE List | Through 1.15.21 | affected |
References
4plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.21/booster/controller.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3027368%40form-maker&new=3027368%40form-maker&sfp_email=&sfph_mail= wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/d55c832b-f558-4e8a-8301-33dd38d39ef1?source=cve