Cross-Site Request Forgery Vulnerability in CP Contact Form with PayPal Plugin for WordPress
CVE-2024-13758

6.5MEDIUM

Key Information:

Vendor
Codepeople
Status
Cp Contact Form With Paypal
Vendor
CVE Published:
30 January 2025

Summary

The CP Contact Form with PayPal plugin for WordPress is susceptible to a Cross-Site Request Forgery vulnerability due to inadequate nonce validation in its initialization functions. This flaw allows unauthenticated attackers to manipulate plug-in behavior by sending forged requests, potentially enabling them to add unauthorized discount codes if they can induce a site administrator to click a malicious link. All versions up to and including 1.3.52 are impacted, emphasizing the need for immediate updates and security measures.

Affected Version(s)

CP Contact Form with PayPal * <= 1.3.52

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/cp-contact-for...
https://wordpress.org/plugins/cp-contact-form-with-paypal...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.