CVE-2024-12184

—

CVSS 3.1

5.3 medium

EPSS

<1%p32

Published

Feb 1, 2025 (Feb 1, 2025)

Modified

Jun 17, 2026

Description

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the accua_forms_download_submitted_file() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to download other user submitted forms.

Vendors: cimatti
Products: wordpress contact forms
Ecosystems: WordPress
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.