PT-2024-39230 · WordPress · Quform

Khayal Farzaliyev + 1 · Published 2024-11-08 · Updated 2024-11-12 · CVE-2024-8756

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: The Quform - WordPress Form Builder plugin versions up to, and including, 2.20.0

Description: The issue allows unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users via the saveUploadedFile function. This makes it possible for attackers to access sensitive information. Files uploaded via forms created before version 2.21.0 will remain vulnerable to exposure after upgrading.

Recommendations: For versions up to, and including, 2.20.0, to fully patch the plugin, site administrators should download any previously uploaded files, delete previously existing files and forms, and create the forms again after upgrading to version 2.21.0. As a temporary workaround, consider disabling the saveUploadedFile function until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-8756

Affected Products

Quform

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-8756 · Security Note
• https://codecanyon.net/item/quform-wordpress-form-builder/706149 · Note
• https://t.me/cvenotify/101182 · Telegram Post
• https://twitter.com/CVEnew/status/1855126028521177361 · Twitter Post
• https://t.me/cvedetector/10276 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/beb8ea66-3cd7-452f-9e64-8439de0ddc55?source=cve · Note