CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.
Explanation of Vulnerability in Simple Terms
Contact Form by WPForms versions up to 1.9.2.2 lack proper authorization checks, allowing authenticated users to modify form data or settings they should not have access to. An attacker with a low-privilege account can change form configurations or submission data without proper permission validation. Update to a version newer than 1.9.2.2 to resolve this issue.
What an attacker can do
Modify form settings or submission data without proper authorization.
Potential impact on your site
Form data integrity may be compromised; unauthorized users can alter forms or submissions.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
