« Volver al listado

CVE-2022-0141

Estado: ModificadaAlta (8.1)—

The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vfbpro — Visual Form Builder

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-0141",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Visual Form Builder",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.8",
              "lessThan": "3.0.8",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-04-12T12:15:08.237",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/2adc8390-bb19-4adf-9805-e9c462d14d22",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://www.fortiguard.com/zeroday/FG-VD-21-081",
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/2adc8390-bb19-4adf-9805-e9c462d14d22",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.fortiguard.com/zeroday/FG-VD-21-081",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks"
    },
    {
      "lang": "es",
      "value": "El plugin Visual Form Builder de WordPress versiones anteriores a 3.0.8 no aplica las comprobaciones de nonce, lo que podría permitir a atacantes hacer que un administrador o editor con sesión iniciada elimine y restaure entradas de formulario arbitrarias por medio de ataques de tipo CSRF"
    }
  ],
  "lastModified": "2026-06-17T04:20:02.507",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vfbpro:visual_form_builder:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2525917B-7FE5-465E-9AF3-0C716783530B",
              "versionEndExcluding": "3.0.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}