CVE-2023-48318 WordPress Contact Form Email plugin <= 1.3.41 - Captcha Bypass vulnerability

Q: What is CVE-2023-48318?

CVE-2023-48318 is a medium-severity vulnerability in CodePeople Contact Form Email, published on 4 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2023-48318 being exploited?

There is no known exploitation of CVE-2023-48318 in the wild and no public exploit code.

Q: How do I fix CVE-2023-48318?

No fix has been published for CVE-2023-48318 yet. Limit exposure of the affected software until one is available.

Medium 5.3 Published 4 Jun 2024 Updated 28 Apr 2026

Attackers can bypass captcha protection in the Contact Form Email plugin, allowing automated spam or brute-force attacks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-48318?

CVE-2023-48318 is a medium-severity vulnerability in CodePeople Contact Form Email, published on 4 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from n/a through 1.3.41.

Weakness: CWE-307

Which versions are affected by CVE-2023-48318?

It affects 1 product.

Products include Codepeople Contact Form Email.

How do I fix CVE-2023-48318?

No fix has been published for CVE-2023-48318 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-48318 being exploited?

There is no known exploitation of CVE-2023-48318 in the wild and no public exploit code.

Sources

Also known as GHSA-fh57-3wxg-c48h.