Attention, WordPress users! If you're utilizing the Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder, you must be aware of a significant security vulnerability (CVE-2024-2771) present in all versions up to, and including, 5.1.16. This vulnerability could potentially allow unauthenticated attackers to grant users with Fluent Form management permissions, making it easy for them to gain access to the plugin's settings and features. Moreover, these attackers can also delete manager accounts. In this post, we will dive into the specifics of the vulnerability and ways to mitigate its impact.

Vulnerability Details

The vulnerability lies in the missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint. Authenticated plugins with minimal permissions could exploit this lacking check to grant the management permissions unauthorizedly. This unrestricted access could result in unauthorized changes in contact form configurations, leaking submissions, and unauthorized management of plugin settings.

Here's a simple example to demonstrate the vulnerability

POST /wp-json/fluentform/v1/managers
Content-Type: application/json

{
  "id": "2",
  "capabilities": [
    "ff_manager"
  ]
}

In this code snippet, the attacker would send a POST request to the vulnerable REST API endpoint and modify user #2's capabilities.

Original References

The vulnerability was first discovered by Wordfence security researchers, who analyzed and responsibly disclosed the issue to the plugin's developers. You can read their detailed blog post on the vulnerability here.

Mitigation and Steps to Take

To safeguard your WordPress website and protect it from potential unauthenticated attackers, follow these steps:

1. Update the plugin: The developers have released a security patch, so make sure to update your Contact Form Plugin by Fluent Forms to the latest version (5.1.17 or later). This can be done through your WordPress dashboard by navigating to Plugins > Installed Plugins, finding the FluentForm plugin, and clicking the "Update Now" link if available.

2. Check user capabilities: Verify if any unauthorized users have been granted Fluent Form management permissions. Revoke permissions if necessary.

3. Keep your WordPress installation up to date: Regularly update your WordPress core and other installed plugins to minimize exposure to new vulnerabilities.

Conclusion

The privilege escalation vulnerability (CVE-2024-2771) in the Contact Form Plugin by Fluent Forms can have potentially severe implications for your WordPress website. Make sure to follow the steps mentioned above to protect your site and keep attackers at bay. Additionally, keep an eye out for security-related updates and advisories from plugin developers, and don't hesitate to reach out for professional assistance if needed.

Timeline

Published on: 05/18/2024 08:15:06 UTC
Last modified on: 05/20/2024 13:00:34 UTC