WordPress Plugin Vulnerabilities

All-in-one Floating Contact Form < 2.1.4 - Unauthenticated Unauthorised Action

Description

The plugin does not have authorisation check in a function, which could allow unauthenticated users to perform an unauthorised action

Affects Plugins

Plugin icon
mystickyelements
Fixed in 2.1.4

References

CVE
CVE-2023-51362
URL
https://patchstack.com/database/vulnerability/mystickyelements/wordpress-mystickyelements-plugin-2-1-3-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Revan Arifio
Verified
No
WPVDB ID
bd308bed-6115-4ca1-8f86-5967c70796f9

Timeline

Publicly Published
2023-12-26 (about 2 years ago)
Added
2024-01-04 (about 2 years ago)
Last Updated
2024-01-04 (about 2 years ago)

Other

Published
Title
Published
2026-03-04
Title
Membership Plugin – Restrict Content < 3.2.21 - Unauthenticated Privilege Escalation via 'rcp_level'
Published
2025-07-30
Title
Classified Listing < 5.0.1 - Authenticated (Contributor+) Content Injection
Published
2024-09-05
Title
Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin < 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Published
2026-03-02
Title
VW Pet Shop < 1.4.8 - Missing Authorization
Published
2025-10-23
Title
Supervisor < 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update