CVE-2024-0371

2024-02-0522:16:00

CWE-862

[email protected]

web.nvd.nist.gov

cve-2024-0371

wordpress

wpforms

vulnerability

unauthorized modification

data

capability check

authenticated attackers

subscriber access

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.2

Confidence

High

EPSS

Percentile

14.0%

JSON

The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘create_view’ function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to create form views.

Affected configurations

Nvd

Node

formviewswpviews_for_wpformsRange≤3.2.2wordpress

VendorProductVersionCPE
formviewswpviews_for_wpforms*cpe:2.3:a:formviewswp:views_for_wpforms:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
formviewswp	views_for_wpforms	*	cpe:2.3:a:formviewswp:views_for_wpforms::::::wordpress::*

References

plugins.trac.wordpress.org/changeset?old_path=%2Fviews-for-wpforms-lite%2Ftags%2F3.2.2&old=3026471&new_path=%2Fviews-for-wpforms-lite%2Ftags%2F3.2.3&new=3026471&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/a9565693-fd0b-4412-944c-81b3cd79492e?source=cve