{"id":"CVE-2023-5098","aliases":["EUVD-2023-57438","GHSA-8jvw-g6jp-rqqp"],"status":"published","title":"Campaign Monitor Forms \u003c 2.5.6 - Subscriber+ Arbitrary Options Update","description":"The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string \"true\", which could lead to a variety of outcomes, including DoS.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00739,"percentile":0.54857,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2023-10-31T13:54:44Z","modified":"2026-06-17T06:47:31Z","products":[{"vendor":"fatcatapps","product":"campaign_monitor_optin_cat"},{"vendor":"unknown","product":"campaign monitor forms by optin cat"}],"references":[{"url":"https://wpscan.com/vulnerability/3167a83c-291e-4372-a42e-d842205ba722","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5098"},{"url":"https://github.com/advisories/GHSA-8jvw-g6jp-rqqp"}],"sources":{"cve":[{"id":"CVE-2023-5098","title":"Campaign Monitor Forms \u003c 2.5.6 - Subscriber+ Arbitrary Options Update","description":"The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string \"true\", which could lead to a variety of outcomes, including DoS.","status":"published","published":"2023-10-31T13:54:44.176Z","modified":"2025-04-23T16:10:21.446Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:17.149492Z"}],"euvd":[{"id":"EUVD-2023-57438","description":"The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string \"true\", which could lead to a variety of outcomes, including DoS.","status":"published","published":"2023-10-31T13:54:44Z","modified":"2025-04-23T16:10:21Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:13.204099Z"}],"ghsa":[{"id":"GHSA-8jvw-g6jp-rqqp","title":"The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with...","description":"The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string \"true\", which could lead to a variety of outcomes, including DoS.","status":"published","published":"2023-10-31T15:30:23Z","modified":"2023-11-17T05:04:28Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:55:03.903531Z"}],"nvd":[{"id":"CVE-2023-5098","description":"The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string \"true\", which could lead to a variety of outcomes, including DoS.","status":"published","published":"2023-10-31T14:15:12.23Z","modified":"2026-06-17T06:47:31.677Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:08:41.047232Z"}]}}