CVE-2008-0198

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.htmlBroken Link, Exploit, Third Party Advisory
http://securityreason.com/securityalert/3539Broken Link, Third Party Advisory
http://securityvulns.ru/Sdocument546.htmlBroken Link, Third Party Advisory
http://securityvulns.ru/Sdocument667.htmlBroken Link, Third Party Advisory
http://websecurity.com.ua/1600/Third Party Advisory
http://websecurity.com.ua/1641/Third Party Advisory
http://www.securityfocus.com/archive/1/485786/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.htmlBroken Link, Exploit, Third Party Advisory
http://securityreason.com/securityalert/3539Broken Link, Third Party Advisory
http://securityvulns.ru/Sdocument546.htmlBroken Link, Third Party Advisory
http://securityvulns.ru/Sdocument667.htmlBroken Link, Third Party Advisory
http://websecurity.com.ua/1600/Third Party Advisory
http://websecurity.com.ua/1641/Third Party Advisory
http://www.securityfocus.com/archive/1/485786/100/0/threadedBroken Link, Third Party Advisory, VDB Entry

Timeline

Published: Jan 10, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-01995.0PRO-Search 0.17 and earlier allows remote attackers to cause a denial of service via certain values of the show_page and time parameters to CVE-2008-02004.3Multiple cross-site scripting (XSS) vulnerabilities in account/index.html in RotaBanner Local 3 and earlier allow remote attackers to inject CVE-2008-02014.3Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary web CVE-2008-02024.3CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and CVE-2008-02034.3Multiple cross-site scripting (XSS) vulnerabilities in cryptographp/admin.php in the Cryptographp 1.2 and earlier plugin for WordPress allow CVE-2008-02044.3Multiple cross-site scripting (XSS) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier CVE-2008-02054.3Multiple cross-site request forgery (CSRF) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and e CVE-2008-02064.3Multiple cross-site scripting (XSS) vulnerabilities in captcha\captcha.php in the Captcha! 2.5d and earlier plugin for WordPress allow remot CVE-2008-02074.3Multiple cross-site scripting (XSS) vulnerabilities in PRO-Search 0.17 and earlier allow remote attackers to inject arbitrary web script or CVE-2008-02084.3Cross-site scripting (XSS) vulnerability in login.asp in Snitz Forums 2000 3.4.05 and earlier allows remote attackers to inject arbitrary we CVE-2008-02095.8Open redirect vulnerability in Forums/login.asp in Snitz Forums 2000 3.4.06 and earlier allows remote attackers to redirect users to arbitra CVE-2008-02106.4Uebimiau Webmail 2.7.10 and 2.7.2 does not protect authentication state variables from being set through HTTP requests, which allows remote