Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Funnelforms Free plugin for WordPress allows unauthorized post deletion

CVE-2023-5386 · published 2 years ago
Summary

Versions of the Funnelforms Free plugin for WordPress through 3.4 have a security issue that lets certain users delete any post on your site, not just the ones related to the plugin. This could be a big deal if you have sensitive or important content on your site. To fix this, update the plugin to a version that's been patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
funnelforms funnelforms <= 3.4
cpe:2.3:a:funnelforms:funnelforms:*:*:*:*:free:wordpress:*:*
Original advisory text
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3....
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts, including administrator posts, and posts not related to the Funnelforms Free plugin. CVE-2023-5990 appears to be a duplicate of this issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published22 Nov 2023
Updated3 Nov 2026
First seen11 Mar 2026
Sources
CVE-2023-5386 · OSV
CVE-2023-5386 · NVD
Track software like this
Free during beta