CVE-2024-3649: Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation
The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of controls on several product parameters. This makes it possible for unauthenticated attackers to manipulate prices, product information, and quantities for purchases made via the Stripe payment integration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3649?
CVE-2024-3649 is a high severity vulnerability that allows unauthenticated attackers to manipulate product pricing.
How do I fix CVE-2024-3649?
To fix CVE-2024-3649, update the WPForms plugin to version 1.8.7.3 or later.
Which versions of the Contact Form by WPForms are affected by CVE-2024-3649?
CVE-2024-3649 affects all versions of the WPForms Contact Form plugin up to and including 1.8.7.2.
What does CVE-2024-3649 allow unauthorized users to do?
CVE-2024-3649 allows unauthorized users to manipulate product parameters, leading to price manipulation.
Is there any workaround for CVE-2024-3649 until it's patched?
There are no known workarounds for CVE-2024-3649, so immediate updating is recommended.