PT-2021-16084 · WordPress · Contact Form 7 Captcha

Dc11 · Published 2021-08-23 · Updated 2022-07-28 · CVE-2021-24565

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contact Form 7 Captcha WordPress plugin versions prior to 0.0.9

Description The issue concerns a lack of CSRF check when saving settings, allowing an attacker to manipulate a logged-in user with manage options privileges into changing them. Additionally, the settings are not properly escaped when output in attributes, leading to a Stored Cross-Site Scripting issue.

Recommendations For versions prior to 0.0.9, update to version 0.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings page to minimize the risk of exploitation. Avoid using the plugin's settings until the issue is resolved.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2021-24565

Affected Products

Contact Form 7 Captcha

References · 5

• 🔥 https://wpscan.com/vulnerability/97bfef5e-2ee0-491a-a931-4f44c83e5be0 · Exploit
• https://plugins.trac.wordpress.org/changeset/2570402 · Patch
• https://osv.dev/vulnerability/CVE-2021-24565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24565 · Security Note
• https://t.me/cibsecurity/27695 · Telegram Post