CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-1129

Medium Severity
Basixonline
SVRS
30/100
CVSSv3
4.3/10
EPSS
0.00271/1

CVE-2024-1129 affects the NEX-Forms WordPress plugin, allowing unauthorized access to modify form records. This vulnerability exists due to a missing capability check in the set_starred() function, impacting versions up to 8.5.6. Authenticated attackers with even subscriber-level access can exploit this flaw to mark records as starred, potentially disrupting form management. While the CVSS score is 4.3, indicating a medium severity, the SOCRadar Vulnerability Risk Score (SVRS) is 30, suggesting a relatively lower immediate risk compared to critical vulnerabilities scoring above 80. However, any unauthorized data modification introduces potential data integrity issues. Patching this vulnerability is still recommended to prevent misuse and maintain the integrity of your WordPress forms. The ability for low-level users to alter form records could also be leveraged in more complex attack chains.

TAGS
No tags available
VECTOR STRING
CVSS:3.1
AV:N
AC:L
PR:L
UI:N
S:U
C:N
I:L
A:N
PUBLICATION DATE2024-02-29
LAST MODIFIED2025-01-15

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-1129 | NEX-Forms Form Builder Plugin up to 8.5.6 on WordPress set_starred authorization
vuldb.com2025-01-15
CVE-2024-1129 | NEX-Forms Form Builder Plugin up to 8.5.6 on WordPress set_starred authorization | A vulnerability was found in NEX-Forms Form Builder Plugin up to 8.5.6 on WordPress and classified as critical. Affected by this issue is the function set_starred. The manipulation leads to missing authorization. This vulnerability is handled as CVE-2024-1129. The attack may be launched remotely
vuldb.com
rss
forum
news

Social Media

No tweets found for this CVE

Affected Software

Configuration 1
TypeVendorProduct
AppBasixonlinenex-forms

References

ReferenceLink
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1493
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1512
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1539
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1490
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1502
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1524
[email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/53db0f72-3353-42bb-ad75-4c5aa32d7939?source=cve
AF854A3A-2127-422B-91AE-364DA2661108https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1493
AF854A3A-2127-422B-91AE-364DA2661108https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1512
AF854A3A-2127-422B-91AE-364DA2661108https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1539
AF854A3A-2127-422B-91AE-364DA2661108https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1490
AF854A3A-2127-422B-91AE-364DA2661108https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1502
AF854A3A-2127-422B-91AE-364DA2661108https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1524
AF854A3A-2127-422B-91AE-364DA2661108https://www.wordfence.com/threat-intel/vulnerabilities/id/53db0f72-3353-42bb-ad75-4c5aa32d7939?source=cve
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1493
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1512
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1539
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1490
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1502
[email protected]https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1524
[email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/53db0f72-3353-42bb-ad75-4c5aa32d7939?source=cve

CWE Details

CWE IDCWE NameDescription
CWE-862Missing AuthorizationThe software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence