Vulnerability · Published Dec 4, 2023 · Assigned by WPScan
CVE-2023-5990Funnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF
Medium 6.5
In plain English
A medium-severity security flaw in Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.3%top 80.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor | 0 – before 3.4.2 |
References
- https://wpscan.com/vulnerability/0a615ce3-93da-459d-a33f-a2a6e74a2f94 exploit, vdb-entry, technical-description