CVE-2024-34755 MEDIUM

CVE-2024-34755: WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability

Vendor Crm Perks
Product Integration for Contact Form 7 and Salesforce
Weakness CWE-352 · CSRF
Published May 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Salesforce.This issue affects Integration for Contact Form 7 and Salesforce: from n/a through 1.3.9.

Explanation of Vulnerability in Simple Terms

02Summary

The Integration for Contact Form 7 and Salesforce plugin is vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the plugin's behalf without the admin's knowledge or consent. This affects versions up to 1.3.9.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into performing unwanted actions via a malicious webpage.

Potential impact on your site

04Site Impact

An attacker could modify plugin settings or trigger unintended Salesforce integrations if an admin visits a compromised page.

Conditions required to exploit

05Prerequisites

Admin must visit a malicious webpage while logged into the WordPress site.

Key dates

06Disclosure timeline

May 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-9731 Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update CVE-2026-15070 Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter CVE-2026-57758 WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability CVE-2026-64871 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension CVE-2026-65539 WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability