Medium severity · published Jan 16, 2024
CVE-2022-23180
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as…
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Contact Form & Lead Form Elementor Builder · Themehunk
before 1.7.4 · source: NVD
Affected product
CF
Contact Form & Lead Form Elementor Builder
Themehunk
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23180
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23180
Patch
https://plugins.trac.wordpress.org/changeset/2670484
Exploit
https://wpscan.com/vulnerability/da87358a-3a72-4cf7-a2af-a266dd9b4290/
More from Contact Form & Lead Form Elementor Builder
7.1
CVE-2026-32532
WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
6.5
CVE-2025-68046
WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability
6.1
CVE-2024-3637
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege…
6.1
CVE-2021-24967
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform…
5.4
CVE-2023-25969
WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability