The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the submit_quizzes() function due to missing validation on the 'entry_id' user controlled key. This makes it possible for unauthenticated attackers to modify other user's quiz submissions.
CVSS
No CVSS.
References
Configurations
History
25 Nov 2024, 19:57
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | ||
| CPE | cpe:2.3:a:wpmudev:forminator_forms:*:*:*:*:free:wordpress:*:* | |
| References | () https://plugins.trac.wordpress.org/browser/forminator/tags/1.35.1/library/modules/quizzes/front/front-action.php#L548 - Product | |
| References | () https://plugins.trac.wordpress.org/changeset/3172942 - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/fbed35ca-1630-46a4-8b1f-60cc7216f294?source=cve - Third Party Advisory | |
| First Time |
Wpmudev forminator Forms
Wpmudev |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
31 Oct 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-31 06:15
Updated : 2024-11-25 19:57
NVD link : CVE-2024-9700
Mitre link : CVE-2024-9700
JSON object : View
Products Affected
wpmudev
- forminator_forms
CWE
No CWE.