IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
4.9Orta

CVE-2025-3471SureForms < 1.4.4 - Contributor+ Settings Update

SureForms Yayım: (1 yıl önce)

Açıklama

The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action

Zayıflık türü (CWE): CWE-863

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
brainstormforce sureforms < 1.4.4
— SureForms < 1.4.4

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (1)
  • cpe:2.3:a:brainstormforce:sureforms:*:*:*:*:*:wordpress:*:* < 1.4.4

Aynı üründe son açıklar — WordPress plugins & themes

Puansız
CVE-2026-110963

Userplace <= 1.2.0 - Unauthenticated Privilege Escalation

Userplace

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or …

Puansız
CVE-2026-104639

Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook

Razorpay for WooCommerce

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection…