CVE-2024-11353

Summary

CVE-2024-11353 is a vulnerability affecting the SMS for Lead Capture Forms plugin for WordPress. The issue lies in the missing capability check on the delete_message() function, which is present in all versions up to 1.1.0. Consequently, authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to delete arbitrary messages without proper authorization. This could potentially lead to data loss or unintended modifications, making it important for users to update to the latest plugin version as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.