PT-2024-18832 · 10Web · The Form Maker

Tim Coen · Published 2024-03-26 · Updated 2025-11-20 · CVE-2024-2112

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Form Maker by 10Web versions up to, and including, 1.15.22

Description The issue allows unauthenticated attackers to extract sensitive data, including user signatures, due to sensitive information exposure via the signature functionality. This makes it possible for attackers to access sensitive information without proper authentication.

Recommendations For versions up to, and including, 1.15.22: Update the plugin immediately to prevent sensitive data exposure. As a temporary workaround, consider disabling the signature functionality until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-2112

Affected Products

The Form Maker

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-2112 · Security Note
• https://plugins.trac.wordpress.org/changeset?old_path=/form-maker/tags/1.15.22&old=3057012&new_path=/form-maker/tags/1.15.23&new=3057012&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2024-2112 · Vendor Advisory
• https://twitter.com/Cezar_H_Linux/status/1991459457084322085 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1777821430404600274 · Twitter Post
• https://twitter.com/oktsec/status/1772806200708432030 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5652f9c3-3cc9-4541-8209-40117b4d25d9?source=cve · Note