WordPress Plugin Vulnerabilities

CRM Perks Forms < 1.1.6 - Missing Authorization to Unauthenticated Form Submission

Description

The CRM Perks Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the post_form() function in versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to submit forms that should be restricted to authenticated users.

Affects Plugins

Plugin icon
crm-perks-forms
Fixed in 1.1.6

References

CVE
CVE-2024-37463
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1b00e42b-9c03-4a3c-86b7-1552f7700b2f

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Manab Jyoti Dowarah
Verified
No
WPVDB ID
5d8e1828-7015-441e-b0ac-6dbc0353a386

Timeline

Publicly Published
2024-07-01 (about 2 years ago)
Added
2024-07-09 (about 2 years ago)
Last Updated
2024-07-09 (about 2 years ago)

Other

Published
Title
Published
2026-03-20
Title
Punnel <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action
Published
2024-02-09
Title
NextMove Lite < 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation
Published
2025-06-05
Title
Job Board Manager < 2.1.61 - Missing Authorization
Published
2022-03-11
Title
Material Design for Contact Form 7 <= 2.6.4 - Subscriber+ Arbitrary Settings Update leading to DoS
Published
2025-02-11
Title
ZoxPress - The All-In-One WordPress News Theme < 2.12.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion