Funnelforms Free Plugin Vulnerable to PHP Object Injection
CVE-2024-10587

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Interactive Contact Form And Multi Step Form Builder With Drag & Drop Editor – Funnelforms Free
Vendor
CVE Published:
4 December 2024

Summary

The Funnelforms Free plugin for WordPress is susceptible to PHP Object Injection due to improper deserialization of untrusted input. This vulnerability impacts all versions up to and including 3.7.4.1 and allows authenticated attackers with Contributor-level access or higher to inject PHP Objects. Without a known PHP Object Pollution (POP) chain in the vulnerable plugin itself, attackers could exploit this vulnerability if additional plugins or themes are present on the target site. Successful exploitation may lead to potential risks such as arbitrary file deletion, sensitive data retrieval, or remote code execution.

Affected Version(s)

Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free * <= 3.7.4.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/funnelforms-free/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis
.