CVE-2023-30616

Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery due to a missing nonce check. There is potential for a Cross Site Request Forgery for all form blocks, since it allows to send requests to the forms from any website without a user noticing. Users are advised to upgrade to version 1.0.2. There are no known workarounds for this vulnerability.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
GitHub_MCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
VendorProductVersion
epiphform_block
𝑥
< 1.0.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/epiphyt/form-block/commit/cf0012fa0710d906c594346ba775c5dc433a9426
https://github.com/epiphyt/form-block/security/advisories/GHSA-j4c2-7p87-q824
https://github.com/epiphyt/form-block/commit/cf0012fa0710d906c594346ba775c5dc433a9426
https://github.com/epiphyt/form-block/security/advisories/GHSA-j4c2-7p87-q824