CVE-2023-0484: Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks < 1.1.6 - Arbitrary Plugin Activation via CSRF
Published Mar 27, 2023
·Updated
The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Software
1 affected component
HasThemes Contact Form 7 Widget For Elementor Page Builder \& Gutenberg Blocks Wordpress<1.1.6
Event History
Mar 27, 2023
CVE Published
via MITRE·03:37 PM
Data Sourced
via MITRE·03:37 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-0484.
2
What is the severity of CVE-2023-0484?
The severity of CVE-2023-0484 is medium with a CVSS score of 4.3.
3
What software is affected by CVE-2023-0484?
The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before version 1.1.6 is affected.
4
How does the vulnerability in the Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks plugin work?
The plugin does not have CSRF check when activating plugins, allowing attackers to make logged in admins activate arbitrary plugins via a CSRF attack.
5
Is there a fix available for CVE-2023-0484?
There is no information available regarding a fix for CVE-2023-0484 at the moment.