WordPress WP Forms Puzzle Captcha Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2023-44997

8.8HIGH

Key Information:

Vendor
WordPress
Status
WP Forms Puzzle Captcha
Vendor
CVE Published:
11 October 2023

Summary

The WP Forms Puzzle Captcha plugin developed by Nitin Rathod is susceptible to Cross-Site Request Forgery (CSRF), which allows attackers to perform unauthorized actions on behalf of authenticated users. This vulnerability, present in versions 4.1 and below, can potentially compromise the integrity of user interactions on WordPress sites using this plugin. Proper security measures must be implemented to mitigate the risks associated with this vulnerability.

Affected Version(s)

WP Forms Puzzle Captcha <= 4.1

References

https://patchstack.com/database/vulnerability/wp-forms-pu...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rio Darmawan (Patchstack Alliance)
.