CVE-2022-23180

Contact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings Update

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings

Affected

Contact Form & Lead Form Elementor Builder

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.53% chance of exploitation in the next 30 days, 44th percentile

Published

2024-01-16

Updated

2025-06-16

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/da87358a-3a72-4cf7-a2af-a266dd9b4290/

Security advisories

• https://wpscan.com/vulnerability/da87358a-3a72-4cf7-a2af-a266dd9b4290
• https://plugins.trac.wordpress.org/changeset/2670484

References

• CVE Record
• NVD entry