Description
WordPress Plugin Contact Form Builder-a plugin for creating contact and feedback forms is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible. WordPress Plugin Contact Form Builder-a plugin for creating contact and feedback forms version 1.0.68 is vulnerable; prior versions are also affected.
Remediation
Update to plugin version 1.0.69 or latest
References
https://pvagenas.com/vulnerabilities/contact-form-builder-csrf/
https://www.exploit-db.com/exploits/46734
https://packetstormsecurity.com/files/152579/WordPress-Contact-Form-Builder-1.0.67-CSRF-LFI.html
https://plugins.svn.wordpress.org/contact-form-builder/trunk/readme.txt
Related Vulnerabilities
Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2022-26595)
Internet Information Services Other Vulnerability (CVE-2003-0223)
Jenkins Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-3725)
Drupal Core 4.7.x HTTP Response Splitting (4.7.0 - 4.7.7)
Magento Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-7929)