CVE-2024-31272 MEDIUM

CVE-2024-31272: WordPress ARForms Form Builder plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability

Vendor Repute Infosystems
Product ARForms Form Builder
Weakness CWE-352 · CSRF
Published April 12, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.

Explanation of Vulnerability in Simple Terms

02Summary

ARForms Form Builder versions up to 1.6.1 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the form builder without the admin's knowledge or consent. The attacker needs the admin to visit a malicious link or page while authenticated.

What an attacker can do

03Attacker Capabilities

Perform unwanted actions on the form builder by tricking a logged-in admin into visiting a malicious webpage.

Potential impact on your site

04Site Impact

An attacker could modify forms, settings, or data if they trick your admin into clicking a malicious link while logged in.

Conditions required to exploit

05Prerequisites

Admin must be logged in and visit an attacker-controlled webpage or link.

Key dates

06Disclosure timeline

April 12, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-9731 Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update CVE-2026-15212 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update CVE-2026-65540 WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-57723 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability CVE-2026-64791 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager