CVE-2022-23180

MEDIUM 4.3 CVSS 3.1

Published: January 16, 2024
Last modified: June 17, 2026
NVD status: Modified
Reported by: contact@wpscan.com
Weakness: CWE-862
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings

Affected products and versions

Unknown Contact Form & Lead Form Elementor Builder — Before 1.7.4
themehunk contact_form_\&_lead_form_elementor_builder — Before 1.7.4

References

plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2670484 Patch
wpscan.com https://wpscan.com/vulnerability/da87358a-3a72-4cf7-a2af-a266dd9b4290/ Exploit, Third Party Advisory
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References