CVE-2024-0374 in Views for WPForms Plugin
Summary
by MITRE • 02/06/2024
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'create_view' function. This makes it possible for unauthenticated attackers to create views via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2024-0374 affects the Views for WPForms plugin, a WordPress extension designed to display and edit WPForms entries on the frontend of websites. This plugin enables administrators to create custom views for form submissions, providing a user-friendly interface for managing form data. The flaw exists in versions up to and including 3.2.2, making it a persistent issue across a significant portion of the plugin's user base. The vulnerability stems from insufficient security measures within the plugin's core functionality, specifically targeting the create_view function that handles view creation operations.
The technical implementation of this vulnerability involves a critical failure in nonce validation mechanisms within the plugin's codebase. A nonce is a cryptographic token that ensures requests originate from legitimate sources and prevents unauthorized operations. In this case, the plugin fails to properly validate nonces when processing the 'create_view' function, allowing attackers to bypass authentication requirements. This represents a fundamental breakdown in the plugin's security architecture and aligns with CWE-352, which specifically addresses Cross-Site Request Forgery vulnerabilities. The absence of proper nonce verification creates an attack surface where malicious actors can construct forged requests that appear legitimate to the WordPress system.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables unauthenticated attackers to create arbitrary views within the WordPress administration interface. This capability allows attackers to manipulate how form data is displayed and managed on the website, potentially exposing sensitive information or disrupting normal operations. The attack vector requires social engineering to trick administrators into executing malicious actions, typically through crafted links or embedded content. This makes the vulnerability particularly dangerous in environments where administrators frequently visit external websites or interact with potentially compromised content. The compromise can lead to data exposure, unauthorized modifications to form display logic, and potential escalation to full administrative control of the WordPress site.
Mitigation strategies for CVE-2024-0374 should prioritize immediate plugin updates to versions that address the nonce validation issue, as this represents the most direct solution to the vulnerability. Administrators should also implement additional security measures such as restricting access to the WordPress admin interface through IP whitelisting, implementing multi-factor authentication, and conducting regular security audits of installed plugins. The vulnerability demonstrates the importance of proper input validation and authentication mechanisms in WordPress plugins, aligning with ATT&CK technique T1548.003 which covers abuse of group policy or privileges. Organizations should also consider implementing web application firewalls to detect and block suspicious requests attempting to exploit CSRF vulnerabilities, while maintaining comprehensive monitoring of administrative activities to identify potential unauthorized view creation attempts.