PT-2021-15820 · Unknown · Redirection For Contact Form 7

Chloe Chamberland · Published 2021-05-14 · Updated 2021-05-17 · CVE-2021-24280

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Redirection for Contact Form 7 versions prior to 2.3.4

Description The issue allows any authenticated user to inject PHP objects using the import from debug AJAX action.

Recommendations For versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-24280

Affected Products

Redirection For Contact Form 7

References · 4

• 🔥 https://wpscan.com/vulnerability/db4ba6b0-887e-4ec1-8935-ab21d369b329 · Exploit
• 🔥 https://wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2021-24280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24280 · Security Note