PT-2022-10604 · Accessibe+1 · Accessibe+2

John Castro + 1 · Published 2022-10-11 · Updated 2022-10-13 · CVE-2021-36913

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Qube One Redirection for Contact Form 7 plugin version 2.4.0 and earlier

Description The issue allows unauthenticated attackers to change options and inject scripts into the footer HTML, potentially leading to content injection. This requires an additional extension, AccessiBe.

Recommendations For Qube One Redirection for Contact Form 7 plugin version 2.4.0 and earlier, update to a version later than 2.4.0 to resolve the issue.

Fix

Special Elements Injection

Improper Access Control

Weakness Enumeration

CWE-74

CWE-284

Related Identifiers

CVE-2021-36913

Affected Products

Accessibe

Contact Form 7

Qube One Redirection For Contact Form 7

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-36913 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36913 · Vendor Advisory
• https://patchstack.com/database/vulnerability/wpcf7-redirect/wordpress-redirection-for-contact-form-7-plugin-2-4-0-unauthenticated-options-change-vulnerability?_s_id=cve · Note
• https://wordpress.org/plugins/wpcf7-redirect/#developers · Note