CVE-2022-0141 Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRF

2022-04-1211:15:22

CWE-352

WPScan

www.cve.org

cve-2022-0141

visual form builder

entries deletion

restoration

csrf

wordpress plugin

nonce checks

admin

editor

form entries

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

21.6%

JSON

The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks

CNA Affected

[
  {
    "product": "Visual Form Builder",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.0.8",
        "status": "affected",
        "version": "3.0.8",
        "versionType": "custom"
      }
    ]
  }
]