PT-2008-1842 · WordPress · Wp-Contactform

3Apa3A + 1 · Published 2008-01-10 · Updated 2018-10-15 · CVE-2008-0197

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WP-ContactForm plugin for WordPress version 1.5 alpha and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters to the wp-admin/admin.php endpoint, including wpcf email, wpcf subject, wpcf question, wpcf answer, wpcf success msg, wpcf error msg, or wpcf msg. Additionally, the SRC attribute of an IFRAME element is vulnerable.

Recommendations For WP-ContactForm plugin for WordPress version 1.5 alpha and earlier, consider disabling the plugin until a patch is available to prevent exploitation. Restrict access to the wp-admin/admin.php endpoint to minimize the risk of exploitation. Avoid using the parameters wpcf email, wpcf subject, wpcf question, wpcf answer, wpcf success msg, wpcf error msg, or wpcf msg in the affected endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0197

Affected Products

Wp-Contactform

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2008-0197 · Security Note
• http://websecurity.com.ua/1600 · Note
• http://securityfocus.com/archive/1/485786/100/0/threaded · Note
• http://securityvulns.ru/Sdocument546.html · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html · Note
• http://websecurity.com.ua/1641 · Note
• http://securityreason.com/securityalert/3539 · Note
• http://securityvulns.ru/Sdocument667.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0197 · Note