CVE-2022-23180: Contact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings Update
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23180?
CVE-2022-23180 has a medium severity rating as it allows authenticated users to change settings without proper authorization.
How do I fix CVE-2022-23180?
To fix CVE-2022-23180, update the Contact Form & Lead Form Elementor Builder plugin to version 1.7.4 or higher.
Who is affected by CVE-2022-23180?
Any authenticated user, including subscribers, can potentially exploit CVE-2022-23180 if they have access to the plugin.
What type of vulnerability is CVE-2022-23180?
CVE-2022-23180 is an authorization and nonce check vulnerability affecting a WordPress plugin.
When was CVE-2022-23180 disclosed?
CVE-2022-23180 was disclosed in early 2022, highlighting the lack of necessary security checks in the plugin.