漏洞标题
"联系表单插件由流畅表单为Quiz，调查和拖放WP表单构建器<=5.1.16 - 缺失设置更新授权和受限权限提升"
漏洞描述信息
Fluent Forms插件的Contact Form Plugin，用于Quiz，Survey，以及拖放WP Form Builder插件，对于WordPress，在所有版本直到并包括5.1.16，其/wp-json/fluentform/v1/managers REST API端点缺少权限检查，这导致特权提升漏洞。未授权攻击者能够授予具有Fluent Form管理权限的用户，从而获得插件的所有设置和功能的访问权限。这同样也使得未授权攻击者能够删除管理员账户。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
授权机制缺失
漏洞标题
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation
漏洞描述信息
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
WordPress plugin Fluent Forms 安全漏洞
漏洞描述信息
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Fluent Forms 5.1.16 版本及之前版本存在安全漏洞，该漏洞源于缺少对 /wp-json/fluenceform/v1/managers REST API 端点的功能检查，可以进行权限升级的影响。
CVSS信息
N/A
漏洞类别
其他