CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in bestwebsoft Contact Form by BestWebSoft contact-form-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by BestWebSoft: from n/a through <= 4.3.6.
Explanation of Vulnerability in Simple Terms
Contact Form by BestWebSoft versions 4.3.6 and earlier lack proper authorization checks on certain operations. A logged-in user with low privileges can modify form data or settings they should not have access to. The vulnerability does not expose sensitive information or cause service disruption, but allows unauthorized changes to form configuration.
What an attacker can do
Modify contact form settings or data without proper authorization.
Potential impact on your site
Unauthorized users can alter your contact form configuration, potentially disrupting form functionality or redirecting submissions.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
