CVE-2024-32705 HIGH

CVE-2024-32705: WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary Plugin Activation/Deactivation Vulnerability

Vendor Reputeinfosystems

Product ARForms

Weakness CWE-862 · Missing authorization

Published June 9, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

Explanation of Vulnerability in Simple Terms

02Summary

ARForms versions 6.4 and earlier lack proper authorization checks, allowing authenticated users to modify data and disrupt site operations. An attacker with a low-privilege account can bypass access controls to alter form submissions or configuration. The vulnerability affects integrity and availability but not confidentiality. Update to a version newer than 6.4.

What an attacker can do

03Attacker Capabilities

Modify form data and disrupt site availability with a low-privilege user account.

Potential impact on your site

04Site Impact

Form data can be altered or deleted by unauthorized users; site availability may be compromised.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level privileges on the site.

Key dates

06Disclosure timeline

June 9, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-32705 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities