WordPress Plugin Vulnerabilities

Funnelforms Free < 3.4.2 - Missing Authorization to Arbitrary Post Deletion

Description

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts, including administrator posts, and posts not related to the Funnelforms Free plugin.

Affects Plugins

Plugin icon
funnelforms-free
Fixed in 3.4.2

References

CVE
CVE-2023-5386
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/400fe58b-8203-4fd5-a3d3-d30eb1b8cd85

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Alex Thomas, Duc Manh
Verified
No
WPVDB ID
a1e90b3f-2c54-47ce-aae1-baebc40ee681

Timeline

Publicly Published
2023-11-01 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2025-11-12
Title
Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Afosto Disconnect
Published
2026-01-06
Title
Piraeus Bank WooCommerce Payment Gateway < 3.1.5 - Missing Authorization to Unauthenticated Arbitrary Order Status Change
Published
2025-12-24
Title
Car Rental Manager < 1.2.0 - Missing Authorization
Published
2025-06-25
Title
VG WORT METIS < 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
Published
2025-01-06
Title
Jupiter X Core < 4.8.6 - Missing Authorization to Authenticated Library Sync