CVE-2024-1945CWE-862

ARForms Form Builder <= 1.6.4 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletion

High · published May 2, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'arflite_remove_preview_data' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber access and above, to delete arbitrary site options, resulting in loss of availability.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-05-02T16:51Z
EPSS history
Timeline
  • 02 MAY 16:51Z
    ARForms Form Builder <= 1.6.4 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletion
    cvelistv5