CVE-2023-5990 Funnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF
Attackers can trick logged-in admins into deleting or duplicating forms via CSRF, requiring an upgrade to the plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-5990?
CVE-2023-5990 is a medium-severity vulnerability in Unknown Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor, published on 4 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks
Weakness: CWE-352
Which versions are affected by CVE-2023-5990?
It affects 1 product.
Products include Funnelforms Funnelforms Free.
How do I fix CVE-2023-5990?
No fix has been published for CVE-2023-5990 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-5990 being exploited?
There is no known exploitation of CVE-2023-5990 in the wild and no public exploit code.
Other vulnerabilities in Unknown Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor
- CVE-2024-6311 Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2024-6312 Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion
- CVE-2024-5857 Missing authorization in Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
- CVE-2024-7447 Missing authorization in Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
Sources
Also known as GHSA-cpc7-5gxx-6rf4.