PT-2021-15819 · WordPress · Redirection For Contact Form 7

Chloe Chamberland · Published 2021-05-14 · Updated 2021-05-17 · CVE-2021-24279

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Redirection for Contact Form 7 versions prior to 2.3.4

Description The issue allows low-level users, such as subscribers, to install any plugin from the WordPress repository using the import from debug AJAX action.

Recommendations For versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-24279

Affected Products

Redirection For Contact Form 7

References · 4

• 🔥 https://wpscan.com/vulnerability/75f7690d-7f6b-48a8-a9d1-95578a657920 · Exploit
• 🔥 https://wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24279 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24279 · Vendor Advisory