MC4WP < 4.9.10 - Unauthenticated Unpublished Form Preview

2024-01-0300:00:00

wpscan.com

unauthenticated access

missing capability check

data security

unpublished forms

software vulnerability

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on the ‘listen’ function, allowing unauthenticated attackers to preview unpublished forms.

CPENameOperatorVersion
eq4.9.10

CPE	Name	Operator	Version
		eq	4.9.10

References

patchstack.com/database/vulnerability/mailchimp-for-wp/wordpress-mc4wp-plugin-4-9-9-broken-access-control-vulnerability