CVE-2023-2010: Forminator < 1.24.1 - Unauthenticated Race Condition on poll vote
The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this Forminator WordPress plugin vulnerability?
The vulnerability ID of this Forminator WordPress plugin vulnerability is CVE-2023-2010.
What is the title of this Forminator WordPress plugin vulnerability?
The title of this Forminator WordPress plugin vulnerability is 'The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information.'
What is the description of this Forminator WordPress plugin vulnerability?
The description of this Forminator WordPress plugin vulnerability is 'The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll.'
What is the affected software of this Forminator WordPress plugin vulnerability?
The affected software of this Forminator WordPress plugin vulnerability is Incsub Forminator version up to exclusive 1.24.1 running on WordPress.
What is the severity of this Forminator WordPress plugin vulnerability?
The severity of this Forminator WordPress plugin vulnerability is low with a CVSSv3 score of 3.1.
How can this Forminator WordPress plugin vulnerability be exploited?
This Forminator WordPress plugin vulnerability can be exploited by a single user voting multiple times on a poll due to the race condition caused by the lack of atomic operation.
Is there a link to more information about this Forminator WordPress plugin vulnerability?
Yes, you can find more information about this Forminator WordPress plugin vulnerability [here](https://wpscan.com/vulnerability/d0da4c0d-622f-4310-a867-6bfdb474073a).
What is the Common Weakness Enumeration (CWE) ID for this Forminator WordPress plugin vulnerability?
The Common Weakness Enumeration (CWE) ID for this Forminator WordPress plugin vulnerability is 362.
How can I fix this Forminator WordPress plugin vulnerability?
To fix this Forminator WordPress plugin vulnerability, you should update the plugin to version 1.24.1 or later.