CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API due to an inconsistent capability check on several REST endpoints in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with contributor access and higher, to obtain access to or modify forms or entries.
Explanation of Vulnerability in Simple Terms
Kali Forms allows authenticated users with low privileges to read sensitive form data they should not have access to. The plugin fails to properly check permissions before returning form submissions and settings. An attacker with a basic user account can view other users' form responses and configuration details without additional interaction.
What an attacker can do
Read form submissions and settings belonging to other users or forms.
Potential impact on your site
Form data privacy is compromised; user submissions may be exposed to unauthorized site users.
Conditions required to exploit
Attacker must have a low-privilege user account on the WordPress site.
Key dates
External resources
Related vulnerabilities
