CVE-2021-24905

The CVE affects the WordPress plugin Advanced Contact form 7 DB (versions prior to 1.8.7). The vulnerability is in the acf7_db_edit_scr_file_delete AJAX action, which lacks authorization and CSRF checks and does not validate the target file to delete. This allows any authenticated user to delete ...