PT-2025-6610 · WordPress · Formcraft

Anhchangmutrang + 1 · Published 2025-02-18 · Updated 2025-02-24 · CVE-2024-13783

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FormCraft plugin for WordPress versions up to and including 3.9.11

Description The issue arises from a missing capability check in formcraft-main.php, allowing authenticated attackers with Subscriber-level access and above to export all plugin data. This data may contain sensitive information from form submissions.

Recommendations For FormCraft plugin for WordPress versions up to and including 3.9.11, update to a version higher than 3.9.11 to resolve the issue. As a temporary workaround, consider restricting access to the formcraft-main.php file to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-13783

Affected Products

Formcraft

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-13783 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13783 · Vendor Advisory
• https://formcraft-wp.com/changelog · Note
• https://codecanyon.net/item/formcraft-premium-wordpress-form-builder/5335056 · Note
• https://twitter.com/Hossted_OSS/status/1893883849639145615 · Twitter Post
• https://t.me/cvedetector/18318 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f7b45b1d-7ed6-4382-b69c-45ea45e4d0db?source=cve · Note
• https://twitter.com/CVEnew/status/1891811224905458108 · Twitter Post