PT-2020-12660 · Takayuki Miyoshi · Contact Form 7 Datepicker
Ramuel Gall
·
Published
2020-04-07
·
Updated
2020-04-10
·
CVE-2020-11516
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Contact Form 7 Datepicker plugin versions prior to 2.6.1
Description
The issue allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected
wp ajax cf7dp save settings AJAX action and the ui theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, potentially leading to the creation of new administrative users or other actions using the administrator's session.Recommendations
For Contact Form 7 Datepicker plugin versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the
wp ajax cf7dp save settings AJAX action to prevent exploitation. Additionally, avoid using the ui theme parameter in the affected AJAX endpoint until the issue is resolved.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Contact Form 7 Datepicker