UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2024-11205

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization

Severity
Medium 6.5
Published
9 Dec 2024
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.9.2.2
Also known as
EUVD-2024-34017, WPV-3a422fdc71ec
Sources
NVD, WPVulnerability

Description

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.

Affected software

SoftwareAffected versions
WPFormsServers and applications · cpe:a:wpforms:wpforms
  • From 1.8.4 before 1.9.2.2
WPForms LiteWordPress plugins · wp-plugin:wpforms-lite
  • From 1.8.4 before 1.9.2.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-11205
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-11205
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforms-lite/wpforms-184-1921-missing-authorization-to-authenticated-subscriber-payment-refund-and-subscription-cancellation