CVE-2021-24278 Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation

2021-05-1411:38:17

CWE-863

WPScan

www.cve.org

cve-2021-24278

redirection

contact form 7

unauthenticated

nonce generation

wordpress plugin

AI Score

7.9

Confidence

High

EPSS

0.109

Percentile

95.2%

JSON

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.

CNA Affected

[
  {
    "product": "Redirection for Contact Form 7",
    "vendor": "Query Solutions",
    "versions": [
      {
        "lessThan": "2.3.4",
        "status": "affected",
        "version": "2.3.4",
        "versionType": "custom"
      }
    ]
  }
]