PT-2023-22813 · WordPress · Form Block

Daniel Ruf · CVE-2023-30616 · Publicado 2023-04-20 · Atualizado 2023-05-01

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Form block versions prior to 1.0.2

Description The Form block WordPress plugin is subject to a Cross-Site Request Forgery (CSRF) due to a missing nonce check. This allows requests to be sent to forms from any website without the user's knowledge. The issue affects all form blocks, enabling potential CSRF attacks.

Recommendations For versions prior to 1.0.2, upgrade to version 1.0.2 to resolve the issue. At the moment, there is no information about other workarounds for this vulnerability.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-30616

GHSA-J4C2-7P87-Q824

Produtos afetados

Form Block

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30616.json · Exploit
• https://github.com/epiphyt/form-block/security/advisories/GHSA-j4c2-7p87-q824 · Aviso do Fabricante
• https://github.com/epiphyt/form-block/commit/cf0012fa0710d906c594346ba775c5dc433a9426 · Correção
• https://t.me/cibsecurity/62546 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-30616 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-30616 · Aviso do Fabricante
• https://t.me/cvenotify/49540 · Publicação no Telegram