CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-zendesk allows Cross Site Request Forgery.This issue affects WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.3.
Explanation of Vulnerability in Simple Terms
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms versions 1.1.3 and earlier contain a cross-site request forgery vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unauthorized actions on the site without the administrator's knowledge or consent.
What an attacker can do
Perform unauthorized actions on the site by tricking an admin into visiting a malicious page.
Potential impact on your site
An attacker can modify plugin settings or data by exploiting an admin's browser session without their awareness.
Conditions required to exploit
A site administrator must visit a malicious link or page while logged in to the WordPress site.
Key dates
External resources
