CVE-2024-10521: WordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function
First published: Wed Nov 27 2024(Updated: )
The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to delete forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cimatti Contact Forms | <=1.9.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f86e8ccb-a865-4da5-9250-dd715b8cdbe7?source=cve
- https://plugins.trac.wordpress.org/browser/contact-forms/trunk/accua-forms-submissions-page.php#L348
- https://wordpress.org/plugins/contact-forms/#developers
- https://plugins.trac.wordpress.org/browser/contact-forms/trunk/accua-forms-list-page.php#L154
- https://plugins.trac.wordpress.org/changeset/3196728/
Frequently Asked Questions
What is the severity of CVE-2024-10521?
CVE-2024-10521 has been classified as a medium severity vulnerability due to its potential ability to allow unauthorized actions on behalf of users.
How do I fix CVE-2024-10521?
To fix CVE-2024-10521, update the WordPress Contact Forms by Cimatti plugin to version 1.9.3 or later.
What type of vulnerability is CVE-2024-10521?
CVE-2024-10521 is a Cross-Site Request Forgery (CSRF) vulnerability caused by missing or incorrect nonce validation.
Who is affected by CVE-2024-10521?
All users of the WordPress Contact Forms by Cimatti plugin versions up to and including 1.9.2 are affected by CVE-2024-10521.
Can CVE-2024-10521 be exploited by unauthenticated users?
Yes, CVE-2024-10521 can be exploited by unauthenticated users due to the lack of proper nonce validation.
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cimatti
- canonical/cimatti contact forms