CVE-2024-9700

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-9700
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the submit_quizzes() function due to missing validation on the 'entry_id' user controlled key. This makes it possible for unauthenticated attackers to modify other user's quiz submissions.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/forminator/tags/1.35.1/library/modules/quizzes/front/front-action.php#L548 Product
https://plugins.trac.wordpress.org/changeset/3172942 Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/fbed35ca-1630-46a4-8b1f-60cc7216f294?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpmudev:forminator_forms:*:*:*:*:free:wordpress:*:*
History

25 Nov 2024, 19:57

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/forminator/tags/1.35.1/library/modules/quizzes/front/front-action.php#L548 - () https://plugins.trac.wordpress.org/browser/forminator/tags/1.35.1/library/modules/quizzes/front/front-action.php#L548 - Product
References () https://plugins.trac.wordpress.org/changeset/3172942 - () https://plugins.trac.wordpress.org/changeset/3172942 - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/fbed35ca-1630-46a4-8b1f-60cc7216f294?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/fbed35ca-1630-46a4-8b1f-60cc7216f294?source=cve - Third Party Advisory
First Time Wpmudev
Wpmudev forminator Forms
CPE cpe:2.3:a:wpmudev:forminator_forms:*:*:*:*:free:wordpress:*:*

01 Nov 2024, 12:57

Type Values Removed Values Added
Summary
  • (es) El complemento Forminator Forms – Contact Form, Payment Form & Custom Form Builder para WordPress es vulnerable a una referencia directa a objetos insegura en todas las versiones hasta la 1.36.0 incluida a través de la función submission_quizzes() debido a la falta de validación en la clave controlada por el usuario 'entry_id'. Esto permite que atacantes no autenticados modifiquen los cuestionarios enviados por otros usuarios.

31 Oct 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-31 06:15

Updated : 2024-11-25 19:57

NVD link : CVE-2024-9700

Mitre link : CVE-2024-9700

CVE.ORG link : CVE-2024-9700

JSON object : View

Products Affected

wpmudev

  • forminator_forms
CWE
CWE-639

Authorization Bypass Through User-Controlled Key