Constant Contact Forms, 4079de0c7dcbef3d761b9e86ceaee2e13cf52e71

CVE, Research URL: 4079de0c7dcbef3d761b9e86ceaee2e13cf52e71
Home page URL: Security reports for Constant Contact Forms
Application: Constant Contact Forms
Published on: Jun 15, 2023
Research Description: Constant Contact Forms [constant-contact-forms] < 2.0.3 Constant Contact Forms <= 2.0.2 - Missing Authorization via constant_contact_privacy_ajax_handler The Constant Contact Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the constant_contact_privacy_ajax_handler function in versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's privacy agreement settings.
Affected versions: max 2.0.3.
Status: vulnerable