PT-2015-5480 · WordPress · Contact Form

Mallory Adams · Published 2015-03-09 · Updated 2016-08-04 · CVE-2015-1874

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Contact Form DB plugin versions prior to 2.8.32

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmissions page to "wp-admin/admin.php".

Recommendations For Contact Form DB plugin versions prior to 2.8.32, update to version 2.8.32 or later to resolve the issue. As a temporary workaround, consider restricting access to the CF7DBPluginSubmissions page and the wp-admin/admin.php endpoint to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-1874

Affected Products

Contact Form

References · 7

• 🔥 https://security.dxw.com/advisories/csrf-in-contact-form-db-allows-attacker-to-delete-all-stored-form-submissions · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Mar/21 · Exploit
• 🔥 http://packetstormsecurity.com/files/130654/WordPress-Contact-Form-DB-2.8.29-Cross-Site-Request-Forgery.html · Exploit
• https://wordpress.org/plugins/contact-form-7-to-database-extension/changelog · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-1874 · Security Note
• http://securityfocus.com/bid/72964 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1874 · Note