Skip to content
Sign in
Not rated

CVE-2022-0591 The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action,…

Description

The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users

Affected products and versions

Product Affected versions Fixed in
FormCraft 3.8 earliest → < 3.8.28 3.8.28

Other CVEs of FormCraft

The 3 CVEs of FormCraft →
CVE-2023-3501 The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high… 4.8 Medium CVE-2023-2592 The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL… Not rated
Track this CVE