CVE-2022-34867: Unauthenticated Sensitive Information Disclosure in WP Libre Form 2 plugin <= 2.0.8
Summary
CVE-2022-34867: Unauthenticated Sensitive Information Disclosure vulnerability. Affects libreform/libreform versions >= 2.0.0, < 2.0.9. Fixed in 2.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WP Libre Form 2 is a plugin for WordPress that allows users to create and manage forms on their websites. It provides a user-friendly interface for creating custom forms and collecting data from users. The plugin is widely used and has a large user base. However, versions 2.0.0 to 2.0.8 of the plugin are vulnerable to an Unauthenticated Sensitive Information Disclosure vulnerability.
Vulnerability Detail
The Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin allows attackers to list and delete submissions without authentication. This means that an unauthorized user can access and manipulate sensitive information submitted through the forms. The vulnerability affects versions 2.0.0 to 2.0.8 of the plugin. The impact of this vulnerability can be significant, as it exposes sensitive user data and allows for potential data loss or manipulation.
How To Fix
Minimum fixed version
2.0.9
This is the first release that contains the fix.
composer require libreform/libreform:2.0.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the plugin to the latest version to mitigate the risk of unauthorized access and data manipulation.
Conclusion
The Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 poses a significant risk to the security and integrity of user data. It is crucial for users of the plugin to update to version 2.0.9 or later to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libreform/libreform →
FAQ
The vulnerability allows attackers to access and manipulate sensitive information submitted through WP Libre Form 2 plugin forms without authentication. This can lead to data breaches, unauthorized access to user data, and potential data loss or manipulation.
Versions 2.0.0 to 2.0.8 of the WP Libre Form 2 plugin are affected by this vulnerability.
To fix this vulnerability, it is recommended to update the WP Libre Form 2 plugin to version 2.0.9 or later. This version includes a patch that addresses the Unauthenticated Sensitive Information Disclosure vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to update the plugin to the latest version to mitigate the risk.
For more information about this vulnerability, you can visit the official GitHub advisory page: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-29qv-hhg4-6x96/GHSA-29qv-hhg4-6x96.json
