CVE-2024-56276

WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.

We have discovered 153,384 live websites that are affected by CVE-2024-56276.

Run a Free Instant Scan



Affected Software

Product  WPForms
Category Form Builders
Vulnerable Domains153,384 live websites (32% of WPForms install base)
Vulnerable Versions
  • from 0 through 1.9.2.2
Vulnerable Versions Count186 versions ( 81% of all versions)



Details

  • Published - Jan 7, 2025
  • Updated - Apr 28, 2026

Credits

  • Rafie Muhammad | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2024-56276
United States41,365 websites


Germany14,796 websites
France8,712 websites
GB7,959 websites
Italy5,701 websites
Netherlands4,789 websites
Spain4,579 websites
India3,973 websites
Brazil3,846 websites
Poland3,846 websites

Website Distribution by TLD

Number of websites using CVE-2024-56276
.com65,111 websites
.de7,679 websites
.org6,697 websites
.co.uk4,395 websites
.nl4,171 websites
.it4,020 websites
.fr3,643 websites
.com.br3,517 websites
.net3,282 websites
.pl2,917 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-56276

Top websites that are affected by CVE-2024-56276. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****************.com United States*,***
******.com United States*,***
******.com United States*,***
*******.org Germany*,***
*************.com United States*,***
****.bg Bulgaria*,***
****************.org United States**,***
*********.com United States**,***
***********.com Germany**,***
********.com United States**,***
See full domain list

FAQ

A total of 153,384 websites have been identified as vulnerable to CVE-2024-56276, based on global website indexing conducted by WebTechSurvey.
The WPForms is affected by the CVE-2024-56276 vulnerability.
WPForms versions up to and including 1.9.2.2 are vulnerable to CVE-2024-56276.