CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms integration-for-contact-form-7-and-google-sheets allows Cross Site Request Forgery.This issue affects Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.0.9.
Explanation of Vulnerability in Simple Terms
The Integration for Google Sheets plugin for Contact Form 7, WPForms, Elementor, and Ninja Forms versions 1.0.9 and earlier contains a cross-site request forgery (CSRF) vulnerability. An attacker can trick a site administrator into performing unintended actions, such as modifying plugin settings or disconnecting Google Sheets integrations, by crafting a malicious link or page. The vulnerability requires the admin to visit the attacker's page while logged into WordPress.
What an attacker can do
Trick an admin into changing plugin settings or disconnecting Google Sheets integrations without their knowledge.
Potential impact on your site
Plugin configuration could be altered or integrations disabled by an attacker without your consent.
Conditions required to exploit
Admin must be logged into WordPress and visit a page controlled by the attacker.
Key dates
External resources
