CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in CRM Perks WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-insightly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.5.
Explanation of Vulnerability in Simple Terms
WP Insightly, a WordPress plugin that integrates contact forms with Insightly CRM, fails to properly check user permissions before allowing access to sensitive data. An authenticated user with low privileges can read information they should not have access to, such as contact details or form submissions from other users. Update to a version newer than 1.1.5.
What an attacker can do
Read sensitive contact and form submission data belonging to other users without proper authorization.
Potential impact on your site
Other users' contact information and form submissions may be exposed to any logged-in user, risking privacy violations and data leaks.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
