CVE-2022-23180

Medium

Description

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings

SeverityMedium

CVSS4.3

Exploit probability—

ProductThemehunk Contact Form \& Lead Form Elementor Builder

PublishedJan 16, 2024

First seenJan 16, 2024

Weakness typeCWE-862Missing authorization

How to fix

Update

themehunk contact_form_\&_lead_form_elementor_builder1.7.4 or later

Patches

plugins.trac.wordpress.org/changeset/2670484

Affected products

Product	Affected versions	Fixed in
themehunk contact_form_\&_lead_form_elementor_builder	v < 1.7.4	1.7.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.