CyberRota Analysis
AI-GeneratedThe FlowForms – Conversational Form Builder plugin for WordPress is vulnerable due to an Insecure Direct Object Reference, allowing authenticated users with contributor-level access or higher to manipulate any form on the site by providing an arbitrary form ID in the REST URL. This vulnerability can lead to unauthorized modifications of content, design, and settings of forms, including those owned by administrators. WordPress site administrators and developers using this plugin should prioritize patching or mitigating this issue to protect against potential exploitation.
Original NVD Description
The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the update_form due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to modify the content, design, and settings of, as well as publish or revert, any form on the site — including forms owned by administrators — by supplying an arbitrary form ID in the REST URL.