CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to add new categories.
Explanation of Vulnerability in Simple Terms
Funnelforms Free versions 3.4 and earlier lack proper authorization checks on certain operations. A logged-in user with low privileges can modify form data or settings they should not have access to. The vulnerability requires an active user account but no special permissions. Update to a version newer than 3.4.
What an attacker can do
A logged-in user can modify form data or settings without proper authorization.
Potential impact on your site
Unauthorized users can alter form configurations, potentially disrupting form functionality or data collection.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
