CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.63.
Explanation of Vulnerability in Simple Terms
Contact Form Email versions up to 1.3.63 lack proper authorization checks, allowing authenticated users to read sensitive data they should not access. An attacker with a low-privilege account can view confidential information without modifying or disrupting the site. Update to a version newer than 1.3.63 to resolve this issue.
What an attacker can do
Read sensitive data from the contact form system that should be restricted to higher-privilege users.
Potential impact on your site
User data and form submissions may be exposed to staff or subscriber accounts that should not have access.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
Related vulnerabilities
