CVE-2024-4157: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues
First published: Wed May 22 2024(Updated: )
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Successful exploitation requires the attacker to have "View Form" and "Manage Form" permissions, which must be explicitly set by an administrator. However, this requirement can be bypassed when this vulnerability is chained with CVE-2024-2771.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fluent Forms | <=5.1.15 | |
| Fluent Forms | <5.1.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4157?
CVE-2024-4157 is classified as a high severity vulnerability due to its potential for PHP Object Injection.
How do I fix CVE-2024-4157?
To fix CVE-2024-4157, update the Fluent Forms Contact Form Plugin to version 5.1.16 or higher.
What versions are affected by CVE-2024-4157?
CVE-2024-4157 affects all versions of the Fluent Forms Contact Form Plugin up to and including 5.1.15.
What vulnerabilities can result from CVE-2024-4157?
CVE-2024-4157 can allow attackers to exploit PHP Object Injection through deserialization of untrusted input.
Is CVE-2024-4157 related to WordPress sites?
Yes, CVE-2024-4157 specifically impacts WordPress sites using the affected versions of the Fluent Forms Contact Form Plugin.
- agent/weakness
- agent/references
- agent/title
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/fluent forms
- canonical/fluent forms
- vendor/fluentforms