CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the accua_forms_download_submitted_file() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to download other user submitted forms.
Explanation of Vulnerability in Simple Terms
Contact Forms by Cimatti versions 1.9.4 and earlier lack proper authorization checks, allowing unauthenticated attackers to read sensitive form data. The vulnerability requires only network access and no user interaction. An attacker can retrieve information that should be restricted to authorized users.
What an attacker can do
Read sensitive form submission data without authentication.
Potential impact on your site
Form submissions and user data collected via the plugin may be exposed to unauthorized access.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
