Vulnerability · Published Oct 31, 2023 · Assigned by WPScan
CVE-2023-5098Campaign Monitor Forms < 2.5.6 - Subscriber+ Arbitrary Options Update
High 8.1
In plain English
A high-severity security flaw in Campaign Monitor Forms by Optin Cat from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.7%top 45.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Campaign Monitor Forms by Optin Cat | 0 – before 2.5.6 |
References
- https://wpscan.com/vulnerability/3167a83c-291e-4372-a42e-d842205ba722 exploit, vdb-entry, technical-description