WPForms Security Flaw: Millions of Sites at Risk for Stripe Refund Mishaps!
WPForms vulnerability CVE-2024-11205 lets subscriber-level users issue Stripe refunds or cancel subscriptions. Affecting versions 1.8.4 to 1.9.2.1, a patch is available in 1.9.2.2. With 3 million sites potentially at risk, upgrading is advisable. Remember, it’s not just the forms that need to be filled—patches do too!
Hot Take:
Well, folks, it seems that WPForms has turned into a master class on how to turn your subscribers into refund enthusiasts! It’s like giving a toddler the keys to your candy store and hoping they don’t discover the chocolate aisle. This bug was basically a VIP backstage pass to a refund rock concert for anyone with a subscriber account. Upgrade now, or risk your Stripe account singing the blues!
Key Points:
- Vulnerability in WPForms could let subscriber-level users issue arbitrary Stripe refunds or cancel subscriptions.
- Identified as CVE-2024-11205, the flaw affects versions 1.8.4 to 1.9.2.1, with a fix in 1.9.2.2.
- The flaw originates from improper usage of ‘wpforms_is_admin_ajax()’ without capability checks.
- Around 3 million sites might be vulnerable as they are not on the latest release branch.
- No active exploitation detected yet, but upgrading or disabling the plugin is advised.
Already a member? Log in here