CVE-2024-34817: WordPress Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability
First published: Fri May 10 2024(Updated: )
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.0.
Credit: audit@patchstack.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CRM Perks Integration for Pipedrive and Contact Form 7 | <=1.2.0 | |
| Softlabbd Upload Fields For Wpforms Wordpress | <=1.2.0 | |
| Elementor | <=1.2.0 | |
| Ninja Forms | <=1.2.0 |
Remedy
Update to 1.2.1 or a higher version.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-34817?
CVE-2024-34817 has been classified as a medium-severity Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2024-34817?
To fix CVE-2024-34817, update the CRM Perks Integration for Pipedrive and Contact Form 7, WPForms, Elementor, or Ninja Forms to the latest version above 1.2.0.
Which applications are affected by CVE-2024-34817?
CVE-2024-34817 affects CRM Perks Integration for Pipedrive and Contact Form 7, WPForms, Elementor, and Ninja Forms versions up to 1.2.0.
Is there a workaround for CVE-2024-34817?
There is no documented workaround for CVE-2024-34817; updating to a secure version is the recommended approach.
What types of attacks are possible due to CVE-2024-34817?
CVE-2024-34817 may be exploited to perform unauthorized actions on behalf of an authenticated user, which could lead to data compromise.
- agent/weakness
- agent/references
- agent/remedy
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/crm perks
- canonical/crm perks integration for pipedrive and contact form 7
- vendor/wpforms
- canonical/softlabbd upload fields for wpforms wordpress
- vendor/elementor
- canonical/elementor
- vendor/ninja forms
- canonical/ninja forms