WPForms Plugin Vulnerability Affects Up To 6 Million Sites via @sejournal, @martinibuster

The WPForms plugin for WordPress exposes websites to a vulnerability that allows attackers to update subscriptions and contented refunds. This flaw enables attackers to modify information they usually should not person entree to.

Missing Capability Check

The vulnerability is owed to a missing capableness cheque successful a relation wrong the plugin called wpforms_is_admin_page, which means that the plugin doesn’t cheque for due permissions of the idiosyncratic attempting to marque a alteration with this function. That means that the plugin allows information to beryllium modified by attackers lacking capable privileges.

Attackers request to get astatine slightest subscriber level permissions successful bid to motorboat an attack. Normally this benignant of onslaught doesn’t attain this precocious of a severity rating. But it whitethorn beryllium due to the fact that sites that person users that wage for a subscription are apt to person subscriber level users. This whitethorn beryllium wherefore the severity level of this authenticated onslaught is higher than general.

The Wordfence announcement explains it similar this:

“The WPForms plugin for WordPress is susceptible to unauthorized modification of information owed to a missing capableness cheque connected the ‘wpforms_is_admin_page’ relation successful versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it imaginable for authenticated attackers, with Subscriber-level entree and above, to refund payments and cancel subscriptions.”

It’s recommended that users of versions WPForms plugin users from versions 1.8.4 up to an including 1.9.2.1 update their plugins.

Read the Wordfence information alert:

WPForms 1.8.4 – 1.9.2.1 – Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

Featured Image by Shutterstock/Tithi Luadthong

SEJ STAFF Roger Montti Owner - Martinibuster.com astatine Martinibuster.com

I person 25 years hands-on acquisition successful SEO, evolving on with the hunt engines by keeping up with the latest ...