Cross-Site Request Forgery Vulnerabilities in Contact Form Generator Plugin for WordPress
CVE-2015-6965

Currently unrated

Key Information:

Vendor

Wordpress
Status
Contact Form Generator
Vendor
CVE Published:
16 September 2015

What is CVE-2015-6965?

The Contact Form Generator plugin for WordPress contains multiple CSRF vulnerabilities that could allow remote attackers to exploit administrative permissions. By crafting malicious requests to the cfg_forms page within the wp-admin area, attackers can potentially hijack administrator sessions and perform unauthorized actions including creating, updating, or deleting form fields and templates. This vulnerability also opens avenues for cross-site scripting (XSS) attacks, further compromising site security.

References

https://wpvulndb.com/vulnerabilities/8176
x_refsource_MISC
http://packetstormsecurity.com/files/133463/WordPress-Con...
x_refsource_MISC
https://www.exploit-db.com/exploits/38086/
exploitx_refsource_EXPLOIT-DB

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.