CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.0.8 via the 'attachments.php' file. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via forms.
Explanation of Vulnerability in Simple Terms
The Tripetto WordPress form builder plugin versions 8.0.8 and earlier expose sensitive information that can be accessed over the network without authentication. An attacker can retrieve this data directly without needing to log in or interact with a site administrator. The exposure is limited to information disclosure with no ability to modify or disable site functionality.
What an attacker can do
Read sensitive information from the plugin without logging in.
Potential impact on your site
Sensitive data stored or processed by Tripetto forms may be visible to unauthenticated visitors.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
