Unauthorized Data Loss Vulnerability in ARForms Form Builder Plugin for WordPress
CVE-2024-1945

7.1HIGH

Key Information:

Vendor

Wordpress
Status
Contact Form, Survey & Popup Form Plugin For WordPress – Arforms Form Builder
Vendor
CVE Published:
2 May 2024

What is CVE-2024-1945?

The ARForms Form Builder plugin for WordPress is susceptible to unauthorized data loss resulting from inadequate capability checks within the 'arflite_remove_preview_data' function. This vulnerability impacts all versions up to and including 1.6.4. Authenticated attackers with subscriber-level access or higher can exploit this flaw to delete arbitrary site options, leading to potential availability issues and erosion of data integrity on affected WordPress sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder * <= 1.6.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/arforms-form-b...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
JSON
.