WS Form LITE <= 1.9.117 - CAPTCHA Bypass

2023-05-23 00:00
Anonymous

Strategic Overview

Status
Patched in 1.9.118
Affected Version
<= 1.9.117
CVSS
5.3Medium
Weakness type
CWE-602 · Client-Side Enforcement of Server-Side Security
CVE
CVE pending
View all WS Form LITE – Drag & Drop Contact Form Builder vulnerabilities

At a glance

This record tracks a medium-severity Client-Side Enforcement of Server-Side Security vulnerability in the WS Form LITE WordPress plugin, affecting versions <= 1.9.117. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.9.118; sites on affected versions should update now. Disclosed May 2023.

Vulnerability Overview

The WS Form LITE plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.9.117. This is due to the existence of a mechanism that allows the CAPTCHA to be bypassed if the client-side field is hidden (or omitted from the request). This makes it possible for unauthenticated attackers to bypass an intended protection mechanism for contact form submissions.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-602: Client-Side Enforcement of Server-Side Security

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Remediation

Update to version 1.9.118, or a newer patched version

How does WordSec protect against this?

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: WS Form LITE 1.9.118 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C