CVE-2021-36886 WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.5.9 - Cross-Site Request Forgery (CSRF) vulnerability

2021-11-1200:00:00

CWE-352

Patchstack

www.cve.org

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

41.9%

JSON

Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).

CNA Affected

[
  {
    "product": "Contact Form 7 Database Addon – CFDB7 (WordPress plugin)",
    "vendor": "CipherCoin",
    "versions": [
      {
        "lessThanOrEqual": "1.2.5.9",
        "status": "affected",
        "version": "<= 1.2.5.9",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/contact-form-cfdb7/wordpress-contact-form-7-database-addon-cfdb7-plugin-1-2-5-9-cross-site-request-forgery-csrf-vulnerability

wordpress.org/plugins/contact-form-cfdb7/#developers