CVE-2022-23180: 
WordPress vulnerability analysis and mitigation

The Contact Form & Lead Form Elementor Builder WordPress plugin before version 1.7.4 contains a security vulnerability identified as CVE-2022-23180. The vulnerability stems from missing authorization and nonce checks in the plugin, which affects the plugin's security controls (WPScan, NVD).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 base score of 4.3 (Medium), vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The technical issue lies in the absence of proper authorization checks and nonce verification in various plugin functionalities, making it susceptible to unauthorized modifications (NVD).

The vulnerability allows any authenticated users, including those with subscriber-level access, to update and modify various plugin settings. This includes the ability to change captcha settings, lead receiving methods, email notification configurations, and other administrative settings (WPScan).

The vulnerability has been patched in version 1.7.4 of the Contact Form & Lead Form Elementor Builder plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).