Unauthorized Data Modification in Funnelforms Free Plugin for WordPress

CVE-2023-5386

Summary

The Funnelforms Free plugin for WordPress has a security flaw that allows authenticated users, with permissions as low as subscriber-level, to delete any post within the system. This vulnerability arises from a lack of necessary capability checks in the fnsf_delete_posts function, enabling potential attackers to compromise data integrity by deleting arbitrary posts, including those of administrators and other important content unrelated to the plugin itself. This issue highlights the critical importance of implementing robust security measures in plugin design to prevent unauthorized data manipulation.

References