CVE-2024-2782: 
WordPress vulnerability analysis and mitigation

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress (CVE-2024-2782) is a security vulnerability affecting versions up to and including 5.1.16. The vulnerability stems from a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint, which allows unauthenticated attackers to modify all of the plugin's settings (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The vulnerability is classified as CWE-862 (Missing Authorization), indicating a fundamental security control issue where authorization checks are absent from the API endpoint (NVD).

The vulnerability allows unauthenticated attackers to modify all plugin settings, potentially leading to website configuration changes and security compromises. With over 400,000 active installations of the Fluent Forms plugin, this vulnerability poses a significant risk to a large number of WordPress websites (SecurityOnline).

The vulnerability is highly exploitable as it requires no authentication (PR:N) and no user interaction (UI:N) to exploit. The attack complexity is low (AC:L), making it relatively straightforward for attackers to take advantage of the vulnerability (NVD).

Website owners using the Fluent Forms plugin should immediately update to version 5.1.17 or later, which contains the security patch for this vulnerability. The fix has been implemented through changes to the GlobalSettingsPolicy.php file (Wordfence).