PT-2024-17471 · WordPress · Kali Forms

Lucio Sá · Published 2024-02-20 · Updated 2025-01-19 · CVE-2024-1218

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kali Forms plugin for WordPress versions prior to 2.3.42

Description The Kali Forms plugin for WordPress is affected by an issue that allows unauthorized access and modification of data via API due to an inconsistent capability check on several REST endpoints. This makes it possible for authenticated attackers, with contributor access and higher, to obtain access to or modify forms or entries.

Recommendations For versions prior to 2.3.42, update to version 2.3.42 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST endpoints to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-1218

Affected Products

Kali Forms

References · 6

• https://osv.dev/vulnerability/CVE-2024-1218 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3036466/kali-forms/trunk?contextall=1&old=3029334&old_path=%2Fkali-forms%2Ftrunk · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-1218 · Security Note
• https://twitter.com/CVEnew/status/1760019566279709125 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ed1aae32-6040-4c42-b8a7-4c3be371a8c0?source=cve · Note
• https://t.me/cvenotify/107886 · Telegram Post