WordPress plugin CFDB7 安全漏洞

🗓️ 02 May 2024 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 2 Views

CFDB7 WordPress plugin allows data leakage from user uploaded files via cfdb7_before_send_mail.

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of the cfdb7_before_send_mail() function in the Contact Form 7 Database Addon (CFDB7), a content management system for WordPress websites. This vulnerability allows attackers to gain unauthorized access to protected information.	30 Apr 202400:00	–	bdu_fstec
CVE	CVE-2024-3870	2 May 202416:52	–	cve
Cvelist	CVE-2024-3870 Contact Form 7 Database Addon – CFDB7 <= 1.2.6.8 - Unauthenticated Sensitive Information Exposure	2 May 202416:52	–	cvelist
EUVD	EUVD-2024-32438	3 Oct 202520:07	–	euvd
NVD	CVE-2024-3870	2 May 202417:15	–	nvd
Patchstack	WordPress Contact Form 7 Database Addon – CFDB7 Plugin <= 1.2.6.8 is vulnerable to Sensitive Data Exposure	29 Apr 202400:00	–	patchstack
Patchstack	WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.6.8 - Unauthenticated Sensitive Information Exposure vulnerability	29 Apr 202411:50	–	patchstack
Positive Technologies	PT-2024-3151 · WordPress · Contact Form 7 Database Addon – Cfdb7	16 Apr 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-3870	23 May 202509:21	–	redhatcve
Vulnrichment	CVE-2024-3870 Contact Form 7 Database Addon – CFDB7 <= 1.2.6.8 - Unauthenticated Sensitive Information Exposure	2 May 202416:52	–	vulnrichment

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/995a6c1d-fb49-4953-9828-f6594ac45fa7
plugins	www.plugins.trac.wordpress.org/browser/contact-form-cfdb7/trunk/contact-form-cfdb-7.php
plugins	www.plugins.trac.wordpress.org/changeset/3077090/
cxsecurity	www.cxsecurity.com/cveshow/CVE-2024-3870/

30 Dec 2025 00:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15.3

EPSS0.00982

SSVC

WordPress plugin data leakage unauthenticated access uploaded files cfdb7_before_send_mail