CVE-2024-5309: Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fvexportcsv, resetsettings, savesettings, savecolumnssettings, getanalyticsdata, geteventlogsdata, deletesubmissions, and getsubmissions functions in all versions up to, and including, 1.4.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple unauthorized actions. NOTE: This vulnerability is partially fixed in version 1.4.12.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5309?
CVE-2024-5309 has been classified as a high severity vulnerability due to the potential for unauthorized data access and modification.
How do I fix CVE-2024-5309?
To mitigate CVE-2024-5309, update the Form Vibes – Database Manager for Forms plugin to version 1.4.13 or later.
Who is affected by CVE-2024-5309?
Any user running versions of the Form Vibes plugin for WordPress prior to 1.4.13 is vulnerable to CVE-2024-5309.
What actions are vulnerable due to CVE-2024-5309?
CVE-2024-5309 allows unauthorized access to several actions including fv_export_csv, reset_settings, and get_analytics_data.
When was CVE-2024-5309 disclosed?
CVE-2024-5309 was disclosed recently as a vulnerability affecting the Form Vibes plugin within the WordPress ecosystem.