CVE-2021-24280 Redirection for Contact Form 7 < 2.3.4 - Authenticated PHP Object Injection

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the importfromdebug AJAX action to inject PHP objects...

CVE-2021-24278 Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7rgetnonce AJAX action to retrieve a valid nonce for any WordPress action/function...

CVE-2021-24281 Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Post Deletion

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the deleteactionpost AJAX action to delete any post on a target site...

CVE-2021-24280

The CVE-2021-24280 entry relates to the WordPress plugin Redirection for Contact Form 7 (versions prior to 2.3.4). The vulnerability allows an authenticated user (e.g., a subscriber) to use the import_from_debug AJAX action to inject PHP objects. This is described consistently across multiple sou...

CVE-2021-24282 Redirection for Contact Form 7 < 2.3.4 - Unprotected AJAX Actions

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7rresetsettings to reset the plugin’s settings, wpcf7raddaction to...

WordPress 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...

PT-2021-15820

Name of the Vulnerable Software and Affected Versions Redirection for Contact Form 7 versions prior to 2.3.4 Description The issue allows any authenticated user to inject PHP objects using the import from debug AJAX action. Recommendations For versions prior to 2.3.4, update to version 2.3.4 or...

WordPress plugin 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...

PT-2021-15818

Name of the Vulnerable Software and Affected Versions Redirection for Contact Form 7 WordPress plugin versions prior to 2.3.4 Description The issue allows unauthenticated users to retrieve a valid nonce for any WordPress action or function using the wpcf7r get nonce AJAX action. Recommendations F...

PT-2021-15821

Name of the Vulnerable Software and Affected Versions Redirection for Contact Form 7 WordPress plugin versions prior to 2.3.4 Description The issue allows any authenticated user to delete any post on a target site using the delete action post AJAX action. Recommendations For versions prior to...

PT-2021-15822

Name of the Vulnerable Software and Affected Versions Redirection for Contact Form 7 versions prior to 2.3.4 Description The issue allows any authenticated user, such as a subscriber, to utilize various AJAX actions within the plugin. This enables an attacker to perform several actions, for...

WordPress Contact Form Check Tester Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Contact Form Check Tester Plugin 1.0.2 and...

WordPress plugin 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A PHP object injection vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...

WordPress plugin 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...

CVE-2021-24279: Incorrect Authorization

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the importfromdebug AJAX action to install any plugin from the WordPress repository...

CVE-2021-24280: Deserialization of Untrusted Data

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the importfromdebug AJAX action to inject PHP objects...

CVE-2021-24282: Incorrect Authorization

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7rresetsettings to reset the plugin’s settings, wpcf7raddaction to...

CVE-2021-24281: Incorrect Authorization

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the deleteactionpost AJAX action to delete any post on a target site...

CVE-2021-24278: Incorrect Authorization

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7rgetnonce AJAX action to retrieve a valid nonce for any WordPress action/function...

WordPress plugin 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...