Vulnerability · Published Feb 28, 2022 · Assigned by WPScan

CVE-2021-24688Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion

Medium 4.3

In plain English

A medium-severity improper access control in Orange Form from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS NVD)4.3Medium

Exploit odds (30 days)0.4%top 62.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure that the post belong to them (or that they are allowed to perform such action on it)

Affected products (as reported)

Vendor	Product	Versions
Unknown	Orange Form	1.0.1 – through 1.0.1

Weakness: CWE-284

References

https://wpscan.com/vulnerability/78bc7cf1-7563-4ada-aec9-af4c943e3e2c x_refsource_MISC