Cross-Site Request Forgery Vulnerability in Contact Form Builder by vcita for WordPress

CVE-2023-2301

What is CVE-2023-2301?

The Contact Form Builder by vcita plugin for WordPress is susceptible to Cross-Site Request Forgery due to insufficient nonce validation in the ls_parse_vcita_callback function. This vulnerability allows unauthenticated attackers to manipulate plugin settings and inject harmful JavaScript by deceiving an administrator into executing an unintended action, such as clicking a malicious link. It highlights the critical need for robust verification mechanisms to prevent exploits that can compromise website integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References