Formgent
Monthly
Missing authorization checks in the FormGent WordPress plugin (versions through 1.12.2) allow an authenticated user holding only a subscriber-level account to reach form-management functionality and data normally reserved for higher-privileged roles, yielding high confidentiality impact and limited integrity impact. The flaw is network-reachable and needs no user interaction, but it does require a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1), so sites that permit open user self-registration are the most exposed while registration-restricted sites are considerably less at risk. No public exploit identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Missing authorization checks in the FormGent WordPress plugin (versions through 1.12.2) allow an authenticated user holding only a subscriber-level account to reach form-management functionality and data normally reserved for higher-privileged roles, yielding high confidentiality impact and limited integrity impact. The flaw is network-reachable and needs no user interaction, but it does require a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1), so sites that permit open user self-registration are the most exposed while registration-restricted sites are considerably less at risk. No public exploit identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).