PT-2021-15822 · WordPress · Redirection For Contact Form 7

Chloe Chamberland · Published 2021-05-14 · Updated 2021-05-17 · CVE-2021-24282

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Redirection for Contact Form 7 versions prior to 2.3.4

Description The issue allows any authenticated user, such as a subscriber, to utilize various AJAX actions within the plugin. This enables an attacker to perform several actions, for example, using wpcf7r reset settings to reset the plugin's settings or wpcf7r add action to add actions to a form.

Recommendations For versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX actions wpcf7r reset settings and wpcf7r add action to prevent unauthorized modifications.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-24282

Affected Products

Redirection For Contact Form 7

References · 5

• 🔥 https://wpscan.com/vulnerability/def87e69-bade-431b-b101-d463a26406e9 · Exploit
• 🔥 https://wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24282 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24282 · Vendor Advisory
• https://t.me/cvenotify/14436 · Telegram Post