WordPress HT Conctact Form 7 Plugin < 1.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software HT Conctact Form 7 Type Plugin Vulnerable versions 1.1.6 Fixed in 1.1.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-0484 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fbf0e64729ba Credits Lana Codes Required...

CVE-2023-0484

The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...

CVE-2023-0484 Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks < 1.1.6 - Arbitrary Plugin Activation via CSRF

The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...

CVE-2023-0484

The CVE-2023-0484 entry refers to the WordPress plugin “Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks” (pre-1.1.6) that lacks CSRF protection when activating plugins, enabling a CSRF attack to trigger activation of arbitrary plugins by an authenticated admin. The vulnerabili...

CVE-2023-0484 Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks < 1.1.6 - Arbitrary Plugin Activation via CSRF

The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...