CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1217 – Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation
https://notcve.org/view.php?id=CVE-2024-1217
19 Feb 2024 — The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the await_plugin_deactivation function in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with subscriber access or higher, to deactivate any active plugins. El complemento Contact Form builder with drag & drop for WordPress – Kali Forms para WordPress es vulnerable a la desactivació... • https://plugins.trac.wordpress.org/changeset/3036466/kali-forms/trunk?contextall=1&old=3029334&old_path=%2Fkali-forms%2Ftrunk • CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1218 – Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization
https://notcve.org/view.php?id=CVE-2024-1218
19 Feb 2024 — The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API due to an inconsistent capability check on several REST endpoints in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with contributor access and higher, to obtain access to or modify forms or entries. El complemento Contact Form builder with drag & drop for WordPress – Kali Forms para WordPress es vu... • https://plugins.trac.wordpress.org/changeset/3036466/kali-forms/trunk?contextall=1&old=3029334&old_path=%2Fkali-forms%2Ftrunk • CWE-862: Missing Authorization •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22305 – WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object References (IDOR)
https://notcve.org/view.php?id=CVE-2024-22305
17 Jan 2024 — Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects Contact Form builder with drag & drop for WordPress – Kali Forms: from n/a through 2.3.36. Vulnerabilidad de omisión de autorización a través de clave controlada por el usuario en ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms. Este problema afecta a Contact Form builder with drag & drop for WordPress – Kali Forms:... • https://patchstack.com/database/vulnerability/kali-forms/wordpress-kali-forms-plugin-2-3-38-insecure-direct-object-references-idor-vulnerability?_s_id=cve • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36720 – Kali Forms <= 2.1.1 - Missing Authorization to Settings Update
https://notcve.org/view.php?id=CVE-2020-36720
21 Aug 2020 — The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated attacker to change (or delete) the plugin's settings. • https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities • CWE-862: Missing Authorization •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36712 – Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion
https://notcve.org/view.php?id=CVE-2020-36712
21 Aug 2020 — The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kaliforms_form_delete_uploaded_file function lacking any privilege or user protections. This makes it possible for unauthenticated attackers to delete any site post or page with the id parameter. • https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities • CWE-862: Missing Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36717 – Kali Forms <= 2.1.1 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2020-36717
21 Aug 2020 — The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to incorrect nonce handling throughout the plugin's function. This makes it possible for unauthenticated attackers to access the plugin's administrative functions via forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities • CWE-352: Cross-Site Request Forgery (CSRF) •