CVE-2023-2010: Forminator < 1.24.1 - Unauthenticated Race Condition on poll vote
First published: Tue Jul 04 2023(Updated: )
The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Forminator | <1.24.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this Forminator WordPress plugin vulnerability?
The vulnerability ID of this Forminator WordPress plugin vulnerability is CVE-2023-2010.
What is the title of this Forminator WordPress plugin vulnerability?
The title of this Forminator WordPress plugin vulnerability is 'The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information.'
What is the description of this Forminator WordPress plugin vulnerability?
The description of this Forminator WordPress plugin vulnerability is 'The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll.'
What is the affected software of this Forminator WordPress plugin vulnerability?
The affected software of this Forminator WordPress plugin vulnerability is Incsub Forminator version up to exclusive 1.24.1 running on WordPress.
What is the severity of this Forminator WordPress plugin vulnerability?
The severity of this Forminator WordPress plugin vulnerability is low with a CVSSv3 score of 3.1.
How can this Forminator WordPress plugin vulnerability be exploited?
This Forminator WordPress plugin vulnerability can be exploited by a single user voting multiple times on a poll due to the race condition caused by the lack of atomic operation.
Is there a link to more information about this Forminator WordPress plugin vulnerability?
Yes, you can find more information about this Forminator WordPress plugin vulnerability [here](https://wpscan.com/vulnerability/d0da4c0d-622f-4310-a867-6bfdb474073a).
What is the Common Weakness Enumeration (CWE) ID for this Forminator WordPress plugin vulnerability?
The Common Weakness Enumeration (CWE) ID for this Forminator WordPress plugin vulnerability is 362.
How can I fix this Forminator WordPress plugin vulnerability?
To fix this Forminator WordPress plugin vulnerability, you should update the plugin to version 1.24.1 or later.
- agent/type
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/title
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- vendor/incsub
- canonical/forminator