CVE-2024-5808

Published: Jul 30, 2024Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF attack

Affected (1)

Products: Masdiblogs: Wp Ajax Contact Form

Masdiblogs

1 product

Wp Ajax Contact Form

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Masdiblogs Wp Ajax Contact Form	Up to 2.2.2

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://wpscan.com/vulnerability/1783bbce-3cc3-4a7e-a491-b713cee8278b/

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/1783bbce-3cc3-4a7e-a491-b713cee8278b/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.