CVE-2023-51358 MEDIUM

CVE-2023-51358: WordPress Block IPs for Gravity Forms Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Bright Plugins
Product Block IPs for Gravity Forms
Weakness CWE-352 · CSRF
Published December 29, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Bright Plugins Block IPs for Gravity Forms.This issue affects Block IPs for Gravity Forms: from n/a through 1.0.1.

Explanation of Vulnerability in Simple Terms

02Summary

Block IPs for Gravity Forms versions up to 1.0.1 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a site administrator, performs unauthorized actions such as modifying IP block settings or altering form configurations. The vulnerability requires the admin to click the link or visit the page while logged in.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into modifying IP block settings or Gravity Forms configuration without their knowledge.

Potential impact on your site

04Site Impact

An attacker can change which IPs are blocked or modify Gravity Forms settings if an admin is tricked into clicking a link.

Conditions required to exploit

05Prerequisites

Admin must click a malicious link or visit an attacker-controlled page while logged into the WordPress site.

Key dates

06Disclosure timeline

December 29, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-15080 Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071 CVE-2026-64876 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension CVE-2016-20067 WordPress CP Polls 1.0.8 Cross-Site Request Forgery CVE-2026-65464 WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-24537 WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerability