CVE-2024-12713: SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handleexportform() function due to a missing capability check. This makes it possible for unauthenticated attackers to export data from password protected, private, or draft posts that they should not have access to.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12713?
CVE-2024-12713 is classified as a medium severity vulnerability due to the potential for information exposure.
How do I fix CVE-2024-12713?
To fix CVE-2024-12713, update the SureForms – Drag and Drop Form Builder for WordPress plugin to version 1.2.3 or later.
What does CVE-2024-12713 exploit?
CVE-2024-12713 exploits a lack of capability checks in the handle_export_form() function within the SureForms plugin.
Who is affected by CVE-2024-12713?
Any user of the SureForms – Drag and Drop Form Builder for WordPress plugin on versions up to and including 1.2.2 is affected by CVE-2024-12713.
Can CVE-2024-12713 be exploited remotely?
Yes, CVE-2024-12713 can be exploited by unauthenticated attackers to gain information from affected WordPress sites.