CVE-2008-0198 WP-ContactForm <= 1.5.1 - Cross-Site Request Forgery
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress wp-contactform(WordPress) | <= 1.5.1 | No fix listed |
| wp-contactform project wp-contactform | = 1.5-alpha | No fix listed |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- 20080103 securityvulns.com russian vulnerabilities digest broken-link exploit mailing-list third-party-advisory
- 3539 broken-link third-party-advisory
- securityvulns.ru broken-link third-party-advisory
- securityvulns.ru broken-link third-party-advisory
- websecurity.com.ua third-party-advisory
- websecurity.com.ua third-party-advisory
- 20080103 securityvulns.com russian vulnerabilities digest broken-link mailing-list third-party-advisory vdb-entry