CVE Vulnerability

CVE-2021-24688

The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure that the post belong to them (or that they are allowed to perform such action on it)

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

4.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wpscan.com/vulnerability/78bc7cf1-7563-4ada-aec9-af4c943e3e2c Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:orange-form_project:orange-form:*:*:*:*:*:wordpress:*:*
Information

Published : 2022-02-28 09:15

Updated : 2022-03-07 06:33

NVD link : CVE-2021-24688

Mitre link : CVE-2021-24688

Products Affected
No products.
CWE
CWE-352