CVE-2024-22305: 
WordPress vulnerability analysis and mitigation

The Contact Form builder with drag & drop for WordPress – Kali Forms plugin contains an Authorization Bypass Through User-Controlled Key vulnerability (CVE-2024-22305). This security issue affects all versions up to and including 2.3.36. The vulnerability was discovered on January 17, 2024, and was publicly disclosed on January 31, 2024 (Patchstack).

The vulnerability is classified as an Insecure Direct Object Reference (IDOR) issue, identified as CWE-639 (Authorization Bypass Through User-Controlled Key). It received a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. The vulnerability stems from missing validation on a user-controlled key, which could allow unauthorized access to objects (NVD, WPScan).

The vulnerability makes it possible for unauthenticated attackers to access objects they do not have proper authorization to view, potentially leading to unauthorized access to sensitive information and system compromise (WPScan).

The vulnerability has been fixed in version 2.3.37 of the Kali Forms plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).