CVE-2023-5990
Funnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
04 Dec 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks