MC4WP <= 4.9.9 is vulnerable to Broken Access Control vulnerability

Unauthenticated

Published
2023-12-26

The MC4WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'listen' function in versions up to, and including, 4.9.9. This makes it possible for unauthenticated attackers to preview unpublished forms.

CVE

https://www.cve.org/CVERecord?id=CVE-2023-51682

CVSS

Score:5.3

Severity:Medium

Version: 4.9.9

There is a patch available in v4.9.10 and we strongly recommend you update to this version as soon as possible.