The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:NWpforms
APPWpforms1.8.4 – 1.9.2.2 (excl.)
Related vulnerabilities
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission paramete...
WPForms 1.7.8 zawiera lukę typu cross-site scripting w funkcji importu suwaka oraz parametrze tab. Atakujący m...
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordP...
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Inco...
The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could al...