CVE-2023-5098

Campaign Monitor Forms < 2.5.6 - Subscriber+ Arbitrary Options Update

High · published October 31, 2023

CVSS v3.1
8.1
EPSS
1%
Percentile
53.7
In the wild
Unconfirmed
What it is

The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00730 · 53.7th percentile
Published
2023-10-31T13:54Z
EPSS history
Timeline
  • 31 OCT 13:54Z
    Campaign Monitor Forms < 2.5.6 - Subscriber+ Arbitrary Options Update
    cvelistv5