CVE-2024-2112

MEDIUM

The Form Maker by 10Web - Info Disclosure

Title source: llm

Description

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.15.22 via the signature functionality. This makes it possible for unauthenticated attackers to extract sensitive data including user signatures.

References (2)

Core 2

Core References

Patch

https://plugins.trac.wordpress.org/changeset?old_path=/form-maker/tags/1.15.22&old=3057012&new_path=/form-maker/tags/1.15.23&new=3057012&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/5652f9c3-3cc9-4541-8209-40117b4d25d9?source=cve

Scores

CVSS v3 5.9

EPSS 0.0070

EPSS Percentile 48.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-287

Status published

Products (2)

10web/Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.22

10web/form_maker < 1.15.23

Published Apr 09, 2024

Tracked Since Feb 18, 2026