WordPress Plugin Vulnerabilities

FormCraft <= 1.2.1 - Cross-Site Request Forgery (CSRF)

Description

The FormCraft – Contact Form Builder for WordPress WordPress plugin was affected by a Cross-Site Request Forgery (CSRF) security vulnerability.

Affects Plugins

Plugin icon
formcraft-form-builder
Fixed in 1.2.2

References

CVE
CVE-2019-5920
CVE
CVE-2019-15114
URL
https://jvn.jp/en/jp/JVN83501605/index.html

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Masaki Saito of TDU Cryptography Lab
Submitter
Ryan Dewhurst
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
81b2a5a0-09aa-4691-9e3d-4131bb7d4665

Timeline

Publicly Published
2019-02-26 (about 7 years ago)
Added
2019-03-13 (about 7 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2025-07-03
Title
RD Contacto <= 1.4 - Cross-Site Request Forgery to Settings Update
Published
2024-08-22
Title
Visual Sound <= 1.03 - Cross-Site Request Forgery to Settings Update
Published
2022-04-11
Title
Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRF
Published
2025-12-30
Title
Movies Bulk Importer <= 1.0 - Cross-Site Request Forgery
Published
2025-08-22
Title
Tutor LMS < 1.20 - Settings Update via CSRF