PT-2022-13158 · WordPress · Contact Form 7 Material Design

Krzysztof Zając · Published 2022-04-04 · Updated 2023-08-02 · CVE-2022-0404

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Material Design for Contact Form 7 WordPress plugin versions 2.6.4 and earlier

Description The issue allows any logged-in user, even those with low roles such as Subscriber, to set arbitrary options to true due to a lack of authorization checks when processing requests to the "cf7md dismiss notice" action. This could potentially lead to Denial of Service by breaking the site.

Recommendations For Material Design for Contact Form 7 WordPress plugin versions 2.6.4 and earlier, update to a version later than 2.6.4 to resolve the issue. As a temporary workaround, consider restricting access to the "cf7md dismiss notice" action to minimize the risk of exploitation.

Exploit

Fix

DoS

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-0404

Affected Products

Contact Form 7 Material Design

References · 7

• 🔥 https://wpscan.com/vulnerability/6d0932bb-d515-4432-b67b-16aba34bd285 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0404 · Security Note
• https://t.me/cvenotify/55007 · Telegram Post
• https://t.me/cvenotify/28397 · Telegram Post
• https://t.me/cvenotify/28399 · Telegram Post
• https://t.me/cvenotify/28749 · Telegram Post