WordPress Plugin Vulnerabilities

Funnelforms Free < 3.4.2 - Missing Authorization to Test Email Sending

Description

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to send test emails to an arbitrary email address.

Affects Plugins

Plugin icon
funnelforms-free
Fixed in 3.4.2

References

CVE
CVE-2023-5419
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/64248d15-e6a7-442f-b269-e9f629d297d3

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Alex Thomas
Verified
No
WPVDB ID
1780b98b-a169-47ff-ab5a-4e98050d3c5c

Timeline

Publicly Published
2023-11-01 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2022-01-28
Title
Perfect Brands for WooCommerce < 2.0.5 - Subscriber+ Arbitrary Brand Creation
Published
2024-01-17
Title
Getwid – Gutenberg Blocks < 2.0.5 - Missing Authorization to Recaptcha API Key Modification
Published
2023-09-04
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization to Sensitive Information Exposure
Published
2026-01-13
Title
Reservation <= 1.7 - Missing Authorization to Unauthenticated Settings Update
Published
2022-11-07
Title
LoginPress < 1.6.3 - Unauthenticated Settings Update