Lucene search

WordfenceCVELIST:CVE-2024-3649

HistoryMay 02, 2024 - 4:52 p.m.

CVE-2024-3649

2024-05-0216:52:12

Wordfence

www.cve.org

cve-2024-3649

contact form

wpforms

drag & drop form builder

wordpress

vulnerability

price manipulation

product parameters

unauthenticated attackers

stripe payment integration

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

20.6%

JSON

The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of controls on several product parameters. This makes it possible for unauthenticated attackers to manipulate prices, product information, and quantities for purchases made via the Stripe payment integration.

CNA Affected

[
  {
    "vendor": "smub",
    "product": "Contact Form by WPForms – Drag & Drop Form Builder for WordPress",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.8.7.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/changeset/3075634

plugins.trac.wordpress.org/changeset/3075634/wpforms-lite/trunk/assets/js/integrations/stripe/wpforms-stripe-payment-element.js

www.wordfence.com/threat-intel/vulnerabilities/id/68a509ae-9943-4b9a-8ede-2b5732e96e6d?source=cve

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

20.6%

JSON

Related for CVELIST:CVE-2024-3649