WordPress WPB Popup for Contact Form 7 plugin <= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form vulnerability

🗓️ 19 Nov 2024 01:05:47Reported by Arkadiusz HydzikType

patchstack

patchstack🔗 patchstack.com👁 1 Views

Unauthenticated arbitrary shortcode execution in WPB Popup for Contact Form 7 (≤1.7.5) by Ark Hydzik.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-11038	19 Nov 202411:11	–	circl
CNNVD	WordPress plugin WPB Popup for Contact Form 代码注入漏洞	19 Nov 202400:00	–	cnnvd
CVE	CVE-2024-11038	19 Nov 202411:02	–	cve
Cvelist	CVE-2024-11038 WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup <= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form	19 Nov 202411:02	–	cvelist
EUVD	EUVD-2024-33735	3 Oct 202520:07	–	euvd
NVD	CVE-2024-11038	19 Nov 202411:15	–	nvd
Patchstack	WordPress WPB Popup for Contact Form 7 Plugin <= 1.7.5 is vulnerable to Broken Access Control	19 Nov 202400:00	–	patchstack
Positive Technologies	PT-2024-16721 · WordPress · Wpb Popup For Contact Form 7	19 Nov 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-11038	5 Feb 202501:44	–	redhatcve
Vulnrichment	CVE-2024-11038 WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup <= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form	19 Nov 202411:02	–	vulnrichment

Vulners

Node

wordpress wpb_popup_for_contact_form_7Range≤1.7.5

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpb-popup-for-contact-form-7/wpb-popup-for-contact-form-7-showing-the-contact-form-7-popup-on-button-click-cf7-popup-175-unauthenticated-arbitrary-shortcode-execution-via-wpb-pcf-fire-contact-form

19 Nov 2024 01:05Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.3

EPSS0.01504

SSVC

unauthenticated access arbitrary shortcode execution wordpress popup plugin contact form seven version 1.7.5