CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.9.3.
Explanation of Vulnerability in Simple Terms
Contact Form by WPForms versions up to 1.9.9.3 lack proper authorization checks, allowing authenticated users with low privileges to access sensitive information they should not see. An attacker with a standard user account can read data that should be restricted to administrators or form owners. Update to a version newer than 1.9.9.3 to resolve this issue.
What an attacker can do
Read sensitive form data or settings restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can view confidential form submissions or configuration details.
Conditions required to exploit
Attacker must have a low-privilege user account on the WordPress site.
Key dates
External resources
Related vulnerabilities
