Description

WordPress Plugin weForms-Easy Drag & Drop Contact Form Builder For WordPress is prone to a supply chain attack because of the Polyfill JavaScript library used. The ownership of the library was taken over by malicious threat actors that used the service to redirect victims to malicious websites. WordPress Plugin weForms-Easy Drag & Drop Contact Form Builder For WordPress version 1.6.23 is affected; prior versions may also be affected.

Remediation

Manually remove the use of Polyfill.io from the plugin, or disable and remove the plugin until a fix is available

References

https://www.wordfence.com/threat-intel/vulnerabilities/detail/various-plugins-various-version-use-of-polyfillio

https://sansec.io/research/polyfill-supply-chain-attack

https://plugins.svn.wordpress.org/weforms/trunk/readme.txt

Related Vulnerabilities

Apache HTTP Server Other Vulnerability (CVE-2010-0408)

Oracle Database Server CVE-2018-2575 Vulnerability (CVE-2018-2575)

phpBB Server-Side Request Forgery (SSRF) Vulnerability (CVE-2017-1000419)

Oracle JRE Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2024-21147)

MediaWiki Resource Management Errors Vulnerability (CVE-2015-8002)

Severity

High

Classification

CWE-1372 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update