CVE-2024-0667: CSRF
First published: Sat Jan 27 2024(Updated: )
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.15.21. This is due to missing or incorrect nonce validation on the 'execute' function. This makes it possible for unauthenticated attackers to execute arbitrary methods in the 'BoosterController' class via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| 10Web Form Maker | <=1.15.21 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d55c832b-f558-4e8a-8301-33dd38d39ef1?source=cve
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.21/booster/controller.php#L34
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3027368%40form-maker&new=3027368%40form-maker&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-0667?
CVE-2024-0667 has been classified as a high severity vulnerability due to its potential for Cross-Site Request Forgery.
How do I fix CVE-2024-0667?
To fix CVE-2024-0667, update the Form Maker plugin to the latest version that includes proper nonce validation.
What versions are affected by CVE-2024-0667?
CVE-2024-0667 affects all versions of the Form Maker plugin for WordPress up to and including 1.15.21.
What type of vulnerability is CVE-2024-0667?
CVE-2024-0667 is a Cross-Site Request Forgery vulnerability that arises from insufficient nonce validation.
Can CVE-2024-0667 lead to unauthorized actions on my WordPress site?
Yes, CVE-2024-0667 can allow attackers to perform unauthorized actions on behalf of users due to the CSRF vulnerability.
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/weakness
- agent/remedy
- agent/severity
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/10web
- canonical/10web form maker
- version/10web form maker/1.15.21