CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The RomethemeForm For Elementor plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the export_entries, rtformnewform, and rtformupdate functions in all versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to export arbitrary form submissions, create new forms, or update any post title or certain metadata.
Explanation of Vulnerability in Simple Terms
RTMForm Builder versions 1.1.5 and earlier do not properly check user permissions before allowing access to sensitive form data and settings. An unauthenticated attacker can read form submissions, configuration details, and other protected information without logging in. This affects all installations of the affected versions.
What an attacker can do
Read form submissions, settings, and other protected data without authentication.
Potential impact on your site
Form data and configuration exposed to anyone on the internet; potential data breach of user submissions.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
