CVE-2023-47692 - How Missing Authorization in Flothemes Flo Forms Opens Your WordPress Site to Attack

WordPress is the backbone of millions of websites—blogs, small business sites, portfolios, and more. To make websites beautiful and interactive, site owners rely on plugins and themes. Flothemes is a premium WordPress theme provider best known for its customization tools and a suite of plugins, including Flo Forms—a popular form solution to create contact and booking forms with ease.

Recently, a significant vulnerability has been discovered in Flo Forms, tracked as CVE-2023-47692. This exclusive deep dive will walk you through what went wrong, how a hacker could use this flaw to gain unauthorized access (with practical code snippets), and how you can protect your WordPress site.

What is CVE-2023-47692?

CVE-2023-47692 is a "Missing Authorization" vulnerability in Flo Forms, impacting versions up to and including 1..41. Due to incorrectly configured access control levels in the plugin's code, unauthorized users can perform crucial actions that should be restricted to site admins or specific user roles only.

Put simply, the plugin forgot to check “Who is making this request?” in several places—leaving hidden doors wide open.

Official reference

- NVD - CVE-2023-47692
- Flothemes Flo Forms Plugin WordPress.org

The Vulnerability Explained

Flo Forms' backend actions rely on so-called Ajax actions, which are URLs a logged-in user (like an admin) can use to manage forms, view entries, and more. Secure plugins always check if the person making the request has the right permissions (using something like current_user_can()). Unfortunately, Flo Forms forgot to add these critical checks.

Where Did It Go Wrong?

At the heart of the vulnerability is Flo Forms' use of unsafe functions in its PHP code. Take a look at this simplified version:

// This is a simplification to illustrate the problem.

add_action('wp_ajax_floforms_save_form', 'floforms_save_form');
function floforms_save_form() {
    // Missing check for capability!
    // Anyone can call this endpoint.

    $data = $_POST['form_data'];

    // Saving the form... (dangerous without checks)
    update_option('floforms_form_' . $data['id'], $data);

    echo json_encode(['status' => 'success']);
    wp_die();
}

In the above example, there’s no verification like

if (!current_user_can('manage_options')) { 
    // no permission!
    wp_die('Permission denied'); 
}

Without this, anyone, including logged-out visitors or low-privileged users (like Subscribers), can send commands to create, update, or mess with forms.

How an Attacker Can Exploit This

An attacker just needs to know the right endpoint to send requests to (in this case, /wp-admin/admin-ajax.php). From there, a simple tool like cURL, Postman, or a browser console can be used.

Discover the endpoint:

Flo Forms registers actions such as floforms_save_form (and possibly others like viewing/deleting entries). These are hooked to the Ajax handler at wp-admin/admin-ajax.php.

`bash

curl -X POST "https://victimsite.com/wp-admin/admin-ajax.php?action=floforms_save_form" \

Result:

The malicious form appears on the site, looks official, and can be crafted to phish data, redirect visitors, or even deface the webpage.

Why Is This Dangerous?

- Full Control Over Forms: Attackers can alter how your forms behave, what data they collect, and where that data is sent.
- Sensitive Info Theft: They can inject fields asking for credit card numbers, passwords, or other valuable details—tricking your visitors.
- Website Reputation Damage: Malicious or spammy forms not only break trust but can get your website blacklisted.
- Platform for Further Attacks: Forms could be used for XSS injection, spam sending, or even as a staging point for infecting visitors.

Are you running Flo Forms, version 1..41 or older?

- Check /wp-admin/admin-ajax.php?action=floforms_save_form for public access.

Update Flo Forms:

Ensure you’re running the latest version of Flo Forms. Always update plugins as soon as security patches are released.

Manual Patch:

If you cannot update immediately, edit the plugin file (flo-forms.php) and manually add permission checks to all action handlers.

wp_die('Unauthorized', 403);

}

Monitor Logs:

Check your access logs for POST requests to admin-ajax.php?action=floforms_save_form from unusual IPs/users.

References

- Patch Release Notes (if/when Flothemes publishes them)
- Wordfence Advisory
- WPScan Entry

Conclusion

CVE-2023-47692 is a classic case of insufficient access control—a surprisingly common, yet easily preventable, mistake in WordPress plugin development. If you use Flo Forms, patch now. Always audit your plugins for permission checks, keep everything updated, and watch your logs for suspicious activity.

Timeline

Published on: 01/02/2025 12:15:16 UTC