blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2008-0198

MEDIUM 4.3 CVSS 2.0
Published
January 10, 2008
Last modified
June 16, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-352
CVSS vector
AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a n/a — Versions not specified
  • wp-contactform_project wp-contactform — Version 1.5

References

  • lists.grok.org.uk http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html Broken Link, Exploit, Third Party Advisory
  • securityreason.com http://securityreason.com/securityalert/3539 Broken Link, Third Party Advisory
  • securityvulns.ru http://securityvulns.ru/Sdocument546.html Broken Link, Third Party Advisory
  • securityvulns.ru http://securityvulns.ru/Sdocument667.html Broken Link, Third Party Advisory
  • websecurity.com.ua http://websecurity.com.ua/1600/ Third Party Advisory
  • websecurity.com.ua http://websecurity.com.ua/1641/ Third Party Advisory
  • www.securityfocus.com http://www.securityfocus.com/archive/1/485786/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
  • nvd.nist.gov Official NVD record