CVE-2023-30616 Cross Site Request Forgery due to missing nonce verification in form block
Attackers can force users to submit form data without consent due to missing nonce verification in the Form Block plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-30616?
CVE-2023-30616 is a medium-severity vulnerability in epiphyt form-block, published on 20 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery due to a missing nonce check. There is potential for a Cross Site Request Forgery for all form blocks, since it allows to send requests to the forms from any website without a user noticing. Users are advised to upgrade to version 1.0.2. There are no known workarounds for this vulnerability.
Weakness: CWE-352
Which versions are affected by CVE-2023-30616?
It affects 1 product.
Products include Epiph Form Block.
How do I fix CVE-2023-30616?
No fix has been published for CVE-2023-30616 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-30616 being exploited?
There is no known exploitation of CVE-2023-30616 in the wild and no public exploit code.
Sources
Also known as GHSA-j4c2-7p87-q824.