TI-2023-05520 Aliases CVE-2023-5990 GHSA-cpc7-5gxx-6rf4

Funnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF

LOW 28CWE-352Published 2023-12-04 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks

Why it matters now

EPSS 0.0027 19th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor (Unknown): 3.4.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor	before 3.4.2	3.4.2	Patch available	CNA

Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor VendorUnknown Affected before 3.4.2 Fixed in 3.4.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:funnelforms:funnelforms_free::::::wordpress::*	before 3.4.2	Vulnerable	funnelforms

cpe:2.3:a:funnelforms:funnelforms_free:*:*:*:*:*:wordpress:*:* Versions before 3.4.2 Vulnerable ·funnelforms

Remediation

Fix · CNA Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor (Unknown) Fixed in 3.4.2

Timeline

2026-10-02 Threatist record created from CVE-2023-5990
2026-10-03 Alias added: GHSA-cpc7-5gxx-6rf4

References

Exploit 1

https://wpscan.com/vulnerability/0a615ce3-93da-459d-a33f-a2a6e74a2f94

TI-2024-05855 Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload CVSS 3.1HIGH 7.2
TI-2024-05856 Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion CVSS 3.1MEDIUM 6.5
TI-2024-06901 Missing authorization in funnelforms Interactive Contact Form and Multi Step Form Builder… CVSS 3.1MEDIUM 5.3
TI-2024-05431 Missing authorization in funnelforms Interactive Contact Form and Multi Step Form Builder… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences