4951 matches found
CVE-2024-1778 Admin side data storage for Contact Form 7 <= 1.1.1 - Missing Authorization to Unauthenticated Bookmark Status Alteration
The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ztdcfcfchangebookmark function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter...
CVE-2024-1777 Admin side data storage for Contact Form 7 <= 1.1.1 - Cross-Site Request Forgery
The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the settings update function. This makes it possible for unauthenticated attackers t...
CVE-2024-1777
CVE-2024-1777 concerns the WordPress plugin “Admin side data storage for Contact Form 7.” The vulnerability is a Cross-Site Request Forgery (CSRF) caused by missing or incorrect nonce validation on the plugin’s settings update function, enabling unauthenticated attackers to alter plugin settings ...
CVE-2024-1778
CVE-2024-1778 affects the WordPress plugin “Admin side data storage for Contact Form 7.” The vulnerability is due to a missing capability check in the zt_dcfcf_change_bookmark() function, enabling unauthenticated actors to modify bookmark statuses in all versions up to 1.1.1. Multiple connected s...
CVE-2024-1779 Admin side data storage for Contact Form 7 plugin <= 1.1.1 - Missing Authorization to Unauthenticated Read Status Update
The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ztdcfcfchangestatus function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter t...
CVE-2024-1779
CVE-2024-1779 affects the WordPress plugin “Admin side data storage for Contact Form 7.” The vulnerability stems from a missing capability check in the zt_dcfcf_change_status() function, allowing unauthenticated attackers to modify the read-status of messages. All versions up to and including 1.1...
CVE-2024-1776
The CVE-2024-1776 entry concerns the Admin side data storage for the WordPress plugin Contact Form 7. Affected versions are all up to 1.1.1. Root cause: insufficient escaping of the user-supplied form-id parameter and inadequate preparation in the existing SQL query, enabling an authenticated att...
WordPress Plugin Admin side data storage for Contact Form security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
WordPress Plugin Admin side data storage for Contact Form 7 SQL Injection Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...
PT-2024-18298 · WordPress · Contact Form 7
Name of the Vulnerable Software and Affected Versions: Contact Form 7 plugin for WordPress versions up to, and including, 1.1.1 Description: The Admin side data storage for the Contact Form 7 plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...
WordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Broken Access Control
Software Admin side data storage for Contact Form 7 Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1778 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4b0d358f68f1 Credits zulu...
PT-2024-18300 · WordPress · Contact Form 7
Name of the Vulnerable Software and Affected Versions: Contact Form 7 plugin for WordPress versions up to, and including, 1.1.1 Description: The Admin side data storage for the Contact Form 7 plugin is vulnerable to unauthorized modification of data due to a missing capability check on the zt dcf...
WordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Broken Access Control
Software Admin side data storage for Contact Form 7 Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1779 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d6fbc39c9c32 Credits zulu...
PT-2024-18299 · WordPress · Contact Form 7
Name of the Vulnerable Software and Affected Versions: Contact Form 7 plugin for WordPress versions up to, and including, 1.1.1 Description: The Admin side data storage is vulnerable to unauthorized modification of data due to a missing capability check on the zt dcfcf change bookmark function...
WordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to SQL Injection
Software Admin side data storage for Contact Form 7 Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-1776 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID caefe13b5aa6 Credits zulu caPWN Required...
WordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Admin side data storage for Contact Form 7 Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1777 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 54ff6d4bf8b9...
WordPress Plugin Admin side data storage for Contact Form security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
PT-2024-18297 · WordPress · Contact Form 7
Name of the Vulnerable Software and Affected Versions: Contact Form 7 plugin for WordPress versions up to, and including, 1.1.1 Description: The Admin side data storage for the Contact Form 7 plugin is vulnerable to SQL Injection via the form-id parameter due to insufficient escaping on the...
WordPress Plugin Admin side data storage for Contact Form security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
