Improper access control in Kali Forms for WordPress - #VU45892
Published: August 21, 2020
Vulnerability identifier: #VU45892
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions within kaliforms_update_option_ajax() AJAX action. A remote authenticated user can bypass implemented security restrictions and change plugin settings.
Note, this vulnerability can be also exploited via CSRF attack vector.
Affected software
Kali Forms for WordPress
Remediation
Install updates from vendor's website.
Kali Forms for WordPress - update to 2.1.2