CVE-2024-3927

Katalog CVE

CVSS 5.3 · Medium EPSS 0,43%

Kerentanan Improper Protection of Alternate Path pada bdthemes element pack. Skor CVSS 3.1 5.3 (Medium) menurut wordfence.com.

Deskripsi (NVD)

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an administrators emails. This makes it possible for unauthenticated attackers to bypass the restriction using a +value when submitting the contact form.

Rincian

Terbit di NVD

22 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-424: Improper Protection of Alternate Path

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/3089154 patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3a703fc4-6c61-442e-a637-515e9f501575?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/contact-form/module.php#L1... product