CVE-2024-12201

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12201
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3205245%40hash-form&new=3205245%40hash-form&sfp_email=&sfph_mail= Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/bb81b2ce-583b-411c-b0f5-a233e0d1986b?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:hashthemes:hash_form:*:*:*:*:*:wordpress:*:*
History

27 Feb 2025, 02:45

Type Values Removed Values Added
CPE cpe:2.3:a:hashthemes:hash_form:*:*:*:*:*:wordpress:*:*
First Time Hashthemes hash Form
Hashthemes
References () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3205245%40hash-form&new=3205245%40hash-form&sfp_email=&sfph_mail= - () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3205245%40hash-form&new=3205245%40hash-form&sfp_email=&sfph_mail= - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/bb81b2ce-583b-411c-b0f5-a233e0d1986b?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/bb81b2ce-583b-411c-b0f5-a233e0d1986b?source=cve - Third Party Advisory
Summary
  • (es) El complemento Hash Form – Drag & Drop Form Builder para WordPress es vulnerable al acceso no autorizado debido a una verificación de capacidad faltante al crear estilos de formulario en todas las versiones hasta la 1.2.1 incluida . Esto permite que atacantes autenticados, con acceso de nivel de colaborador y superior, creen nuevos estilos de formulario.

12 Dec 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-12 07:15

Updated : 2025-02-27 02:45

NVD link : CVE-2024-12201

Mitre link : CVE-2024-12201

CVE.ORG link : CVE-2024-12201

JSON object : View

Products Affected

hashthemes

  • hash_form
CWE
CWE-862

Missing Authorization