CVE-2024-2782
HIGH EXPLOITED NUCLEIWordPress FluentForms <= 5.1.16 - Broken Access Control
Title source: nucleiExploitation Summary
CVE-2024-2782 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including whale93. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC demonstrates an unauthenticated REST API endpoint vulnerability in Fluent Forms for WordPress, allowing attackers to modify plugin settings via a crafted POST request. The exploit leverages missing capability checks to alter email recipient settings.
Description
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to modify all of the plugin's settings.
Exploits (1)
This PoC demonstrates an unauthenticated REST API endpoint vulnerability in Fluent Forms for WordPress, allowing attackers to modify plugin settings via a crafted POST request. The exploit leverages missing capability checks to alter email recipient settings.
Nuclei Templates (1)
http.html:"/wp-content/plugins/fluentform/"
body="/wp-content/plugins/fluentform/"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N