A serious security flaw has been identified in WPForms, a WordPress plugin deployed across more than 6 million websites. This vulnerability could enable users with subscriber-level access to issue random Stripe refunds or terminate subscriptions. The issue, identified as CVE-2024-11205, is classified as a high-severity concern due to the prerequisite of authentication. However, the exploitation could be relatively straightforward in most scenarios, as membership systems are commonly present on most sites. The problem affects WPForms from version 1.8.4 to 1.9.2.1, with a resolution introduced in version 1.9.2.2, which was released last month.
WPForms is a user-friendly WordPress form builder that allows the creation of various forms such as contact, feedback, subscription, and payment forms. It supports multiple payment platforms including Stripe, PayPal, and Square. The plugin comes in two versions – a premium version (WPForms Pro) and a free version (WPForms Lite), with the latter being active on over six million WordPress sites.
The vulnerability originates from the incorrect use of the function ‘wpforms_is_admin_ajax()’ to ascertain if a request is an admin AJAX call. This function verifies if the request is from an admin path, but it does not impose capability checks to limit access based on the user’s role or permissions. Consequently, any authenticated user, including subscribers, can trigger sensitive AJAX functions like ‘ajax_single_payment_refund(),’ which initiates Stripe refunds, and ‘ajax_single_payment_cancel(),’ which terminates subscriptions.
The fallout from the exploitation of CVE-2024-11205 could be devastating for website owners, resulting in revenue loss, disruption of business operations, and potential trust issues with their customers. The flaw was unearthed by a security researcher known as ‘vullu164,’ who reported it to Wordfence’s bug bounty program and received a reward of $2,376 on November 8, 2024. Wordfence validated the report and confirmed the exploit, forwarding the complete details to the vendor, Awesome Motive, on November 14. By November 18, Awesome Motive had released the fixed version 1.9.2.2, implementing appropriate capability checks and authorization mechanisms in the affected AJAX functions.
According to data from wordpress.org, about half of all sites using WPForms are not on the latest release branch (1.9.x), indicating that at least 3 million websites are vulnerable. While Wordfence has not identified active exploitation of CVE-2024-11205 in the wild, it is strongly advised to upgrade to version 1.9.2.2 immediately or disable the plugin from your site.
