CVE-2024-2112 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information Exposure
Unauthenticated attackers can extract sensitive user signature data from the Form Maker plugin due to improper authentication checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2112?
CVE-2024-2112 is a medium-severity vulnerability in Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder, published on 9 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.15.22 via the signature functionality. This makes it possible for unauthenticated attackers to extract sensitive data including user signatures.
Weakness: CWE-287
Which versions are affected by CVE-2024-2112?
It affects 1 product.
Products include 10web Form Maker.
How do I fix CVE-2024-2112?
No fix has been published for CVE-2024-2112 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-2112 being exploited?
There is no known exploitation of CVE-2024-2112 in the wild and no public exploit code.
Other vulnerabilities in Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- CVE-2023-4666 Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload
- CVE-2019-10866 SQL injection in n/a
- CVE-2019-11590 Cross-site request forgery in n/a
- CVE-2022-3300 Form Maker by 10Web < 1.15.6 - Admin+ SQLI
- CVE-2024-43220 WordPress Form Maker by 10Web plugin <= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerability
Sources
Also known as GHSA-fr6q-c249-g62p.