CVE-2024-1945: high-severity vulnerability in reputeinfosystems Contact Form, Survey, Quiz &…
ARForms Form Builder <= 1.6.4 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletion
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.4%
The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'arflite_remove_preview_data' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber access and above, to delete arbitrary site options, resulting in loss of availability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Related CVEs — reputeinfosystems Contact Form, Survey, Quiz &…
In the same product, most dangerous first.
CVE-2024-13784CRITICALContact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object InjectionEPSS 0.8%CVE-2023-6828HIGHARForms <= 1.5.8 - Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_urlEPSS 0.4%CVE-2024-13785MEDIUMContact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode ExecutionEPSS 0.3%