{"id":2756,"date":"2024-01-31T18:15:20","date_gmt":"2024-01-31T18:15:20","guid":{"rendered":"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/"},"modified":"2024-01-31T18:15:20","modified_gmt":"2024-01-31T18:15:20","slug":"nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records","status":"publish","type":"post","link":"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/","title":{"rendered":"NEX-Forms &#8211; Ultimate Form Builder &#8211; Contact forms y mucho m\u00e1s &lt;= 8.5.6 &#8211; Falta de autorizaci\u00f3n a trav\u00e9s de restore_records()"},"content":{"rendered":"<div>El plugin NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms y mucho m\u00e1s para WordPress es vulnerable a accesos no autorizados debido a una falta de verificaci\u00f3n de capacidades en la funci\u00f3n restore_records() en todas las versiones hasta, e incluyendo, la versi\u00f3n 8.5.6. Esto permite a atacantes autenticados, con acceso de nivel suscriptor y superior, restaurar registros.<\/div>\n<p><\/p>\n<div>La falta de autorizaci\u00f3n en el plugin NEX-Forms \u2013 Ultimate Form Builder puede ser un riesgo significativo para tu sitio web de WordPress. Esto se debe a que los atacantes autenticados, con niveles de acceso desde suscriptor en adelante, pueden aprovechar la funci\u00f3n restore_records() para restaurar registros de forma no autorizada. Esto significa que los atacantes pueden modificar los registros existentes, lo que puede llevar a la exposici\u00f3n de informaci\u00f3n confidencial o la manipulaci\u00f3n de datos. Para mitigar este problema, se recomienda aplicar una soluci\u00f3n provisional hasta que se publique un parche oficial. Los usuarios pueden desactivar temporalmente el plugin NEX-Forms hasta que se solucione el problema de seguridad. Adem\u00e1s, se recomienda mantener siempre actualizado el software de WordPress y los plugins, ya que las actualizaciones suelen incluir correcciones de seguridad.<\/div>\n<div>En resumen, el plugin NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms y mucho m\u00e1s para WordPress es vulnerable a accesos no autorizados debido a una falta de verificaci\u00f3n de capacidades en la funci\u00f3n restore_records(). Esto puede permitir que atacantes autenticados, con niveles de acceso desde suscriptor en adelante, restauren registros de forma no autorizada. Se recomienda tomar medidas inmediatas para mitigar este riesgo, como desactivar temporalmente el plugin y mantener actualizado el software de WordPress y los plugins.<\/div>\n","protected":false},"excerpt":{"rendered":"<p>El plugin NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms y mucho m\u00e1s para WordPress es vulnerable a accesos no autorizados debido a una falta de verificaci\u00f3n de capacidades en la funci\u00f3n restore_records() en todas las versiones hasta, e incluyendo, la versi\u00f3n 8.5.6. Esto permite a atacantes autenticados, con acceso de nivel suscriptor y superior, [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[472],"class_list":["post-2756","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cve-2024-0907"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.8 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>NEX-Forms - Ultimate Form Builder - Contact forms y mucho m\u00e1s &lt;= 8.5.6 - Falta de autorizaci\u00f3n a trav\u00e9s de restore_records() - SeguridadWordPress.es<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"NEX-Forms - Ultimate Form Builder - Contact forms y mucho m\u00e1s &lt;= 8.5.6 - Falta de autorizaci\u00f3n a trav\u00e9s de restore_records() - SeguridadWordPress.es\" \/>\n<meta property=\"og:description\" content=\"El plugin NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms y mucho m\u00e1s para WordPress es vulnerable a accesos no autorizados debido a una falta de verificaci\u00f3n de capacidades en la funci\u00f3n restore_records() en todas las versiones hasta, e incluyendo, la versi\u00f3n 8.5.6. Esto permite a atacantes autenticados, con acceso de nivel suscriptor y superior, [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/\" \/>\n<meta property=\"og:site_name\" content=\"SeguridadWordPress.es\" \/>\n<meta property=\"article:published_time\" content=\"2024-01-31T18:15:20+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/\",\"url\":\"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/\",\"name\":\"NEX-Forms - Ultimate Form Builder - Contact forms y mucho m\u00e1s &lt;= 8.5.6 - Falta de autorizaci\u00f3n a trav\u00e9s de restore_records() - SeguridadWordPress.es\",\"isPartOf\":{\"@id\":\"http:\/\/127.0.0.1\/#website\"},\"datePublished\":\"2024-01-31T18:15:20+00:00\",\"dateModified\":\"2024-01-31T18:15:20+00:00\",\"author\":{\"@id\":\"\"},\"breadcrumb\":{\"@id\":\"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\/\/127.0.0.1\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"NEX-Forms &#8211; Ultimate Form Builder &#8211; Contact forms y mucho m\u00e1s &lt;= 8.5.6 &#8211; Falta de autorizaci\u00f3n a trav\u00e9s de restore_records()\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/127.0.0.1\/#website\",\"url\":\"http:\/\/127.0.0.1\/\",\"name\":\"SeguridadWordPress.es\",\"description\":\"Recopilaci\u00f3n de vulnerabilidades WordPress.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/127.0.0.1\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"NEX-Forms - Ultimate Form Builder - Contact forms y mucho m\u00e1s &lt;= 8.5.6 - Falta de autorizaci\u00f3n a trav\u00e9s de restore_records() - SeguridadWordPress.es","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/","og_locale":"en_US","og_type":"article","og_title":"NEX-Forms - Ultimate Form Builder - Contact forms y mucho m\u00e1s &lt;= 8.5.6 - Falta de autorizaci\u00f3n a trav\u00e9s de restore_records() - SeguridadWordPress.es","og_description":"El plugin NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms y mucho m\u00e1s para WordPress es vulnerable a accesos no autorizados debido a una falta de verificaci\u00f3n de capacidades en la funci\u00f3n restore_records() en todas las versiones hasta, e incluyendo, la versi\u00f3n 8.5.6. Esto permite a atacantes autenticados, con acceso de nivel suscriptor y superior, [&hellip;]","og_url":"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/","og_site_name":"SeguridadWordPress.es","article_published_time":"2024-01-31T18:15:20+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/","url":"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/","name":"NEX-Forms - Ultimate Form Builder - Contact forms y mucho m\u00e1s &lt;= 8.5.6 - Falta de autorizaci\u00f3n a trav\u00e9s de restore_records() - SeguridadWordPress.es","isPartOf":{"@id":"http:\/\/127.0.0.1\/#website"},"datePublished":"2024-01-31T18:15:20+00:00","dateModified":"2024-01-31T18:15:20+00:00","author":{"@id":""},"breadcrumb":{"@id":"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/127.0.0.1\/nex-forms-ultimate-form-builder-contact-forms-y-mucho-mas-8-5-6-falta-de-autorizacion-a-traves-de-restore_records\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/127.0.0.1\/"},{"@type":"ListItem","position":2,"name":"NEX-Forms &#8211; Ultimate Form Builder &#8211; Contact forms y mucho m\u00e1s &lt;= 8.5.6 &#8211; Falta de autorizaci\u00f3n a trav\u00e9s de restore_records()"}]},{"@type":"WebSite","@id":"http:\/\/127.0.0.1\/#website","url":"http:\/\/127.0.0.1\/","name":"SeguridadWordPress.es","description":"Recopilaci\u00f3n de vulnerabilidades WordPress.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/127.0.0.1\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}},"amp_enabled":true,"_links":{"self":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/2756"}],"collection":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/comments?post=2756"}],"version-history":[{"count":0,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/2756\/revisions"}],"wp:attachment":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/media?parent=2756"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/categories?post=2756"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/tags?post=2756"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}