PT-2023-22813 · WordPress · Form Block

Daniel Ruf · Published 2023-04-20 · Updated 2023-05-01 · CVE-2023-30616

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Form block versions prior to 1.0.2

Description The Form block WordPress plugin is subject to a Cross-Site Request Forgery (CSRF) due to a missing nonce check. This allows requests to be sent to forms from any website without the user's knowledge. The issue affects all form blocks, enabling potential CSRF attacks.

Recommendations For versions prior to 1.0.2, upgrade to version 1.0.2 to resolve the issue. At the moment, there is no information about other workarounds for this vulnerability.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-30616

GHSA-J4C2-7P87-Q824

Affected Products

Form Block

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30616.json · Exploit
• https://github.com/epiphyt/form-block/security/advisories/GHSA-j4c2-7p87-q824 · Vendor Advisory
• https://github.com/epiphyt/form-block/commit/cf0012fa0710d906c594346ba775c5dc433a9426 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-30616 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30616 · Vendor Advisory
• https://t.me/cibsecurity/62546 · Telegram Post
• https://t.me/cvenotify/49540 · Telegram Post