{"id":"CVE-2023-0484","aliases":["EUVD-2023-12534","GHSA-mh46-3hw4-j564"],"status":"published","title":"Contact Form 7 Widget For Elementor Page Builder \u0026 Gutenberg Blocks \u003c 1.1.6 - Arbitrary Plugin Activation via CSRF","description":"The Contact Form 7 Widget For Elementor Page Builder \u0026 Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00278,"percentile":0.20458,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2023-03-27T15:37:28Z","modified":"2026-06-17T05:25:39Z","products":[{"vendor":"hasthemes","product":"contact_form_7_widget_for_elementor_page_builder_\\\u0026_gutenberg_blocks"},{"vendor":"unknown","product":"contact form 7 widget for elementor page builder \u0026 gutenberg blocks"}],"references":[{"url":"https://wpscan.com/vulnerability/e61fb245-0d7f-42b0-9b96-c17ade8c04c5","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0484"},{"url":"https://github.com/advisories/GHSA-mh46-3hw4-j564"}],"sources":{"cve":[{"id":"CVE-2023-0484","title":"Contact Form 7 Widget For Elementor Page Builder \u0026 Gutenberg Blocks \u003c 1.1.6 - Arbitrary Plugin Activation via CSRF","description":"The Contact Form 7 Widget For Elementor Page Builder \u0026 Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack","status":"published","published":"2023-03-27T15:37:28.083Z","modified":"2025-02-19T20:08:19.407Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:34.923818Z"}],"euvd":[{"id":"EUVD-2023-12534","description":"The Contact Form 7 Widget For Elementor Page Builder \u0026 Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack","status":"published","published":"2023-03-27T15:37:28Z","modified":"2025-02-19T20:08:19Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:26.792701Z"}],"ghsa":[{"id":"GHSA-mh46-3hw4-j564","title":"The Contact Form 7 Widget For Elementor Page Builder \u0026 Gutenberg Blocks WordPress plugin before 1...","description":"The Contact Form 7 Widget For Elementor Page Builder \u0026 Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack","status":"published","published":"2023-03-27T18:30:25Z","modified":"2023-04-08T05:00:55Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:54:27.812339Z"}],"nvd":[{"id":"CVE-2023-0484","description":"The Contact Form 7 Widget For Elementor Page Builder \u0026 Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack","status":"published","published":"2023-03-27T16:15:08.333Z","modified":"2026-06-17T05:25:39.447Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:50.908252Z"}]}}