CVE-2024-2368: Mollie Forms <= 2.6.13 - Cross-Site Request Forgery to Arbitrary Post Duplication
The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due to missing or incorrect nonce validation on the duplicateForm() function. This makes it possible for unauthenticated attackers to duplicate forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2368?
CVE-2024-2368 is considered a moderate severity vulnerability due to its potential for exploitation by unauthenticated attackers.
How do I fix CVE-2024-2368?
To fix CVE-2024-2368, update the Mollie Forms plugin to version 2.6.14 or later.
What types of attacks can be performed due to CVE-2024-2368?
CVE-2024-2368 allows attackers to perform Cross-Site Request Forgery attacks, enabling them to duplicate forms without user authentication.
Which versions of the Mollie Forms plugin are affected by CVE-2024-2368?
CVE-2024-2368 affects all versions of the Mollie Forms plugin up to and including version 2.6.13.
What component is vulnerable in the Mollie Forms plugin according to CVE-2024-2368?
The duplicateForm() function in the Mollie Forms plugin is vulnerable due to missing or incorrect nonce validation.