PT-2022-12990 · WordPress · Visual Form Builder

Vishnupriya Ilango · Published 2022-04-12 · Updated 2023-08-02 · CVE-2022-0140

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Visual Form Builder WordPress plugin versions prior to 3.0.6

Description The issue allows unauthenticated users to see form entries or export them as a CSV file due to a lack of access control on entry form export. This can be done using the "vfb-export" endpoint.

Recommendations For versions prior to 3.0.6, update to version 3.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the "vfb-export" endpoint until a patch is applied.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-0140

Affected Products

Visual Form Builder

References · 7

• 🔥 https://wpscan.com/vulnerability/9fa2b3b6-2fe3-40f0-8f71-371dd58fe336 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0140 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0140 · Vendor Advisory
• https://t.me/cvenotify/55008 · Telegram Post
• https://fortiguard.com/zeroday/FG-VD-21-082 · Note
• https://t.me/cvenotify/28754 · Telegram Post
• https://t.me/cibsecurity/40607 · Telegram Post