Cross-Site Request Forgery Vulnerability in Form Maker by 10Web for WordPress
CVE-2024-0667
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 January 2024
What is CVE-2024-0667?
The Form Maker by 10Web plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw is rooted in the absence of proper nonce validation within the 'execute' function, allowing unauthenticated attackers to execute arbitrary methods within the 'BoosterController' class. Attackers could exploit this vulnerability by tricking an administrator into clicking a malicious link, potentially compromising the site's functionality and security.
Affected Version(s)
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder * <= 1.15.21