CVE-2021-24282 Redirection for Contact Form 7 < 2.3.4 - Unprotected AJAX Actions

2021-05-1411:38:17

CWE-863

WPScan

www.cve.org

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.6%

JSON

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more.

CNA Affected

[
  {
    "product": "Redirection for Contact Form 7",
    "vendor": "Query Solutions",
    "versions": [
      {
        "lessThan": "2.3.4",
        "status": "affected",
        "version": "2.3.4",
        "versionType": "custom"
      }
    ]
  }
]