CVE-2024-7447
28.08.2024, 12:15
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsf_af2_handel_file_upload' function in all versions up to, and including, 3.7.3.2. This makes it possible for unauthenticated attackers to upload arbitrary media to the site, even if no forms exist.Enginsight
| Vendor | Product | Version |
|---|---|---|
| funnelforms | interactive_contact_form_and_multi_step_form_builder | 𝑥 ≤ 3.7.3.2 |
| funnelforms | funnelforms_free | 𝑥 < 3.7.4.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration