Unauthorized Data Access in FormCraft Plugin for WordPress

CVE-2024-13783

Summary

The FormCraft plugin for WordPress contains a critical flaw in formcraft-main.php that allows authenticated attackers with Subscriber-level access and higher to bypass security measures and export sensitive data contained in form submissions. This vulnerability arises from a missing capability check, enabling exploitation of all versions up to and including 3.9.11. It poses a serious risk to the integrity and confidentiality of user data, potentially leading to unauthorized exposure of sensitive information.

References