CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to, and including, 3.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all plugin data which may contain sensitive information from form submissions.
Explanation of Vulnerability in Simple Terms
FormCraft versions up to 3.9.11 fail to properly check user permissions before allowing access to certain functions. A logged-in user with low privileges can read sensitive information they should not have access to. The vulnerability requires authentication but does not require user interaction. Update to a version newer than 3.9.11.
What an attacker can do
Read sensitive information from the application without proper authorization.
Potential impact on your site
Logged-in users may access data they should not be able to view, risking exposure of sensitive information.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
