UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2024-10593

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-Site Request Forgery (CSRF)

Severity
Medium 4.3
Published
12 Nov 2024
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.9.2.1
Also known as
WPV-b8750e9c757a
Sources
NVD, WPVulnerability

Description

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.1.6. This is due to missing or incorrect nonce validation on the process_admin_ui function. This makes it possible for unauthenticated attackers to delete WPForm logs via a forged request granted…

Affected software

SoftwareAffected versions
WPFormsServers and applications · cpe:a:wpforms:wpforms
  • Every version before 1.9.2.1
WPForms LiteWordPress plugins · wp-plugin:wpforms-lite
  • Every version before 1.9.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-10593
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-10593
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforms-lite/wpforms-easy-form-builder-for-wordpress-1916-cross-site-request-forgery-csrf-to-plugins-log-deletion