WordPress Plugin Vulnerabilities

Funnelforms Free < 3.4.2 - Missing Authorization to Enable/Disable Dark Mode

Description

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable or disable the dark mode plugin setting.

Affects Plugins

Plugin icon
funnelforms-free
Fixed in 3.4.2

References

CVE
CVE-2023-5387
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb34b44-9fa4-4ebe-b217-b2a42920247f

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Alex Thomas
Verified
No
WPVDB ID
87bc0e6a-8cc8-4310-9288-995f8a19c51c

Timeline

Publicly Published
2023-11-01 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2026-01-06
Title
Reviewify < 1.0.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary WooCommerce Coupon Creation
Published
2026-01-22
Title
Cloudinary <= 3.3.0 - Missing Authorization
Published
2026-03-20
Title
RepairBuddy < 4.1133 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action
Published
2026-02-10
Title
Twitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Update
Published
2025-01-21
Title
WP Hotel Booking < 2.1.7 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval