CVE-2022-23180
Last modified
CVE-2022-23180 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Themehunk | Contact Form \& Lead Form Elementor Builder | < 1.7.4 |
References
- https://wpscan.com/vulnerability/da87358a-3a72-4cf7-a2af-a266dd9b4290/Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/da87358a-3a72-4cf7-a2af-a266dd9b4290/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-23180?
How severe is CVE-2022-23180?
How do I fix CVE-2022-23180?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-23172An attacker can access to "Forgot my password" button, as so…4.3
- CVE-2022-23173this vulnerability affect user that even not allowed to acce…6.3
- CVE-2022-23176WatchGuard Firebox and XTM appliances allow a remote attacke…8.8
- CVE-2022-23178An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159…9.8
- CVE-2022-23179The Contact Form & Lead Form Elementor Builder WordPress plu…4.8
- CVE-2022-2318There are use-after-free vulnerabilities caused by timer han…5.5
- CVE-2022-23181The fix for bug CVE-2020-9484 introduced a time of check, ti…7
- CVE-2022-23182Improper access control in the Intel(R) Data Center Manager …8.8
- CVE-2022-23183Missing authorization vulnerability in Advanced Custom Field…6.5
- CVE-2022-23184In affected Octopus Server versions when the server HTTP and…6.1
- CVE-2022-23186Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (…7.8
- CVE-2022-23187Adobe Illustrator version 26.0.3 (and earlier) is affected b…7.8
Are you affected by CVE-2022-23180?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST