CVE-2024-37463 WordPress CRM Perks Forms plugin <= 1.1.5 - Broken Access Control vulnerability
Attackers can access restricted functionality in the CRM Perks Forms plugin due to missing authorization checks, potentially bypassing access controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-37463?
CVE-2024-37463 is a medium-severity missing authorization vulnerability in CRM Perks Forms, published on 1 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authorization vulnerability in CRM Perks CRM Perks Forms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CRM Perks Forms: from n/a through 1.1.5.
Weakness: CWE-862
Which versions are affected by CVE-2024-37463?
It affects 1 product.
Products include Crmperks Crm Perks Forms.
How do I fix CVE-2024-37463?
No fix has been published for CVE-2024-37463 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-37463 being exploited?
There is no known exploitation of CVE-2024-37463 in the wild and no public exploit code.
Other vulnerabilities in CRM Perks Forms
- CVE-2024-30498 WordPress CRM Perks Forms plugin <= 1.1.4 - Unauthenticated SQL Injection vulnerability
- CVE-2024-30499 WordPress CRM Perks Forms plugin <= 1.1.4 - SQL Injection vulnerability
- CVE-2024-7484 CRM Perks Forms <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2024-30446 WordPress CRM Perks Forms plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2022-38467 WordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerability
Sources
Also known as GHSA-vv32-h72m-mqmf.