Description
The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to read form submission records, modify form configuration options, and delete records belonging to any form they do not own.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rbplugins | Forms Rb | ≤ 1.1.9 | — |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/80b27cde-68d7-439d-aee6-a390035e2022?source=cve
- https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L128
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L128
- https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L623
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L623
- https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L316
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L316
- https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L444
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L444
- https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L190
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L190
- https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L41
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L41