CVE-2024-32512: WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-17 · updated 2026-06-17
Weakness: CWE-602

Description

Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20.

Affected products

boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress: before 1.6.21 — fixed in 1.6.21

How to fix

Upgrade to a fixed version: boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress 1.6.21. Check the vendor advisory for mitigations.

References

https://patchstack.com/database/vulnerability/weforms/wordpress-weforms-plugin-1-6-20-form-submission-restriction-bypass-vulnerability?_s_id=cve
https://patchstack.com/database/vulnerability/weforms/wordpress-weforms-plugin-1-6-20-form-submission-restriction-bypass-vulnerability?_s_id=cve

Get alerted when CVE-2024-32512 or the next vulnerability affects your stack