WP-CFM

WP-CFM has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for WP-CFM has a vendor fix available, so running the current release closes it.

All of these findings were reported by Nguyen Xuan Chien.

Strategic Overview

Avg CVSSMedium

4.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP-CFM vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2024-24706

WP-CFM <= 1.7.8 - Cross-Site Request Forgery via multiple AJAX functions

Read the full analysis

Vulnerability Records

1 records


2024-01-31 00:00	WP-CFM <= 1.7.8 - Cross-Site Request Forgery via multiple AJAX functions WP-CFM <= 1.7.8	`CVE-2024-24706`	4.3 Medium	Nguyen Xuan Chien	Yes

Showing 1–1 of 1 reports