WordPress Contact Form & Lead Form Elementor Builder Plugin Broken Access Control Advisory

Vulnerability Overview Vulnerability Name: WordPress Contact Form & Lead Form Elementor Builder Plugin <= 1.8.4 contains a Broken Access Control vulnerability Vulnerability Type: Broken Access Control Priority: Low Priority CVSS Score: 5.4 Impact Scope Affected Versions: <= 1.8.4 Fixed Version: 1.8.5 or later Risk Description: Such vulnerabilities are often used in large-scale attack campaigns, allowing attackers to compromise tens of thousands of websites simultaneously, regardless of their traffic volume or popularity. Remediation 1. Immediate Action: Update the affected plugin. If you cannot update it yourself, contact your hosting provider or website developer for assistance. 2. Automated Mitigation: Patchstack has released mitigation rules that can block any attacks before updating to the patched version. 3. Manual Update: Update to version 1.8.5 or later to resolve the vulnerability. Patchstack users can enable automatic updates. Details Software: Contact Form & Lead Form Elementor Builder Type: Plugin Vulnerable Version: <= 1.8.4 Fixed Version: 1.8.5 Timeline Report Date: September 10, 2022 Reporter: István Márton Additional Information User Interaction Required: Successful exploitation requires a privileged user to perform specific actions, such as clicking a malicious link, visiting a spoofed page, or submitting a form. Definition of Broken Access Control: Lack of authorization, authentication, or nonce token checks may allow unauthorized users to perform higher-privileged actions. Subscription Weekly WordPress Security Intelligence: Provides weekly WordPress security intelligence, available via subscription. Relevant Links Patchstack Website: Offers vulnerability mitigation, code security, bug bounty services, and more. Resources: Includes partners, vulnerability database, whitepapers, case studies, and more. Footer Copyright: © 2023 Patchstack Links: DPA, Privacy Policy, Accessibility, Terms & Conditions Summary This is a low-priority vulnerability affecting specific versions of a WordPress plugin. Remediation options include immediately updating the plugin or using Patchstack's automated mitigation features.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Contact Form & Lead Form Elementor Builder Plugin Broken Access Control Advisory