JVN#83501605: WordPress plugin "FormCraft" vulnerable to cross-site request forgery

The WordPress plugin “FormCraft” provided by nCrafts contains a cross-site request forgery vulnerability (CWE-352).

Impact

Unintended operations may be performed if a user logs into the WordPress administration screen and browses a malicious page.
Those operations may include generating new forms, inserting JavaScript code to existing forms, and deleting existing forms.

Solution

Update the plugin
Update the plugin according to the information provided by the developer.

Products Affected

• FormCraft 1.2.1 and earlier