CVE-2023-5387
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Summary
CVE-2023-5387 is a vulnerability found in the Funnelforms Free plugin for WordPress versions up to and including 3.4. The issue stems from a missing capability check on the fnsf_af2_trigger_dark_mode function, allowing authenticated attackers with subscriber-level permissions and above to manipulate data and enable or disable the dark mode plugin setting. The risk score for this vulnerability is 5, indicating a medium severity level. The exploitability score is 2.8, categorized as low privileges required and no user interaction needed, with an attack vector through the network. The impact score is 1.4, suggesting low integrity impact and no confidentiality impact. Remediation for this vulnerability should involve updating the Funnelforms Free plugin to a version that addresses the issue. Organizations using vulnerable versions of this plugin should be aware of the potential unauthorized data modification that attackers could carry out through this flaw.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions