CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in PluginsCafe Address Autocomplete via Google for Gravity Forms gf-google-address-autocomplete allows Cross Site Request Forgery.This issue affects Address Autocomplete via Google for Gravity Forms: from n/a through <= 1.3.4.
Explanation of Vulnerability in Simple Terms
The Address Autocomplete via Google for Gravity Forms plugin contains a cross-site request forgery (CSRF) vulnerability in versions up to 1.3.4. An attacker can trick a site administrator into performing unintended actions, such as modifying plugin settings or form configurations, by crafting a malicious link or page. The vulnerability requires the admin to visit the attacker's page while logged in.
What an attacker can do
Trick an admin into changing plugin settings or form data without their knowledge.
Potential impact on your site
Plugin settings or Gravity Forms configurations could be altered by an attacker without your consent.
Conditions required to exploit
Admin must be logged in and visit a page controlled by the attacker.
Key dates
External resources
Related vulnerabilities
