CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
What the vulnerability does
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the await_plugin_deactivation function in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with subscriber access or higher, to deactivate any active plugins.
Explanation of Vulnerability in Simple Terms
Kali Forms through version 2.3.41 lacks proper authorization checks, allowing authenticated users with low privileges to modify form data and settings they should not access. An attacker with a basic user account can change form configurations, potentially altering form behavior or accessing sensitive submission data. Site administrators should update to a version newer than 2.3.41 immediately.
What an attacker can do
Modify form settings and access form data without proper permission checks.
Potential impact on your site
Forms may be altered or disabled by unauthorized users; form submissions could be redirected or exposed.
Conditions required to exploit
Attacker needs a low-privilege user account on the WordPress site; no special interaction required.
Key dates
External resources
Related vulnerabilities
