CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
What the vulnerability does
The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited height and width parameters for CAPTCHA images. This makes it possible for unauthenticated attackers to send multiple requests with large values, resulting in slowing server resources if the server does not mitigate Denial of Service attacks.
Explanation of Vulnerability in Simple Terms
Calculated Fields Form versions up to 5.2.63 do not properly limit resource consumption, allowing an attacker to send repeated requests that exhaust server resources and cause the site to become slow or unresponsive. No authentication is required. The vulnerability affects availability only; attackers cannot read or modify data.
What an attacker can do
Make repeated requests to exhaust server resources and degrade site performance.
Potential impact on your site
Your site may become slow or temporarily unavailable if targeted with resource-exhaustion requests.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
