MEDIUM🇬🇧 English

CVE-2025-3471

CVSS 4.9v3.1pub. 2025-04-30upd. 2025-05-09

The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

  • Brainstormforce Sureforms

    APP
    Brainstormforce
    < 1.4.4
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2025-6691HIGH8.1ten sam produkt

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file ...

CVE-2025-6742HIGH7.5ten sam produkt

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Inje...

CVE-2025-5921MEDIUM5.8ten sam produkt

The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it bac...

CVE-2024-12713MEDIUM5.3ten sam produkt

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exp...

CVE-2025-3513LOW3.5ten sam produkt

The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which cou...