PT-2024-17510 · WordPress · Accept Stripe Payments Using Contact Form 7

Joshua Chan · CVE-2024-12255 · Published 2024-12-12 · Updated 2025-07-02

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Accept Stripe Payments Using Contact Form 7 plugin for WordPress versions up to, and including, 2.5

Description The issue allows unauthenticated attackers to extract configuration information through the cf7sa-info.php file, which returns phpinfo() data. This information can be leveraged in another attack.

Recommendations For versions up to, and including, 2.5, consider removing or restricting access to the cf7sa-info.php file until a patch is available. As a temporary workaround, consider disabling the plugin until a fixed version is released. Restrict access to the plugin's configuration to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-200

CWE-732

Related Identifiers

CVE-2024-12255

Affected Products

Accept Stripe Payments Using Contact Form 7

References · 8

• 🔥 https://wordfence.com/threat-intel/vulnerabilities/id/8a9e1325-1027-41ea-93be-c321aef61dea?source=cve · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12255 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12255 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3205295%40accept-stripe-payments-using-contact-form-7&new=3205295%40accept-stripe-payments-using-contact-form-7&sfp_email=&sfph_mail= · Patch
• https://t.me/cvenotify/127503 · Telegram Post
• https://twitter.com/CVEnew/status/1867171886502695103 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1867224566944195035 · Twitter Post
• https://t.me/cvedetector/12732 · Telegram Post