PT-2024-17553 · WordPress · Custom Skins Contact Form 7

Lucio Sá · Published 2024-12-12 · Updated 2024-12-12 · CVE-2024-12341

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Custom Skins Contact Form 7 plugin for WordPress versions prior to 1.1

Description The issue arises from a missing capability check on the cf7cs action callback function, allowing authenticated attackers with Subscriber-level access and above to update the content of any post and create new skins.

Recommendations For versions prior to 1.1, update to a version that includes the necessary capability checks to prevent unauthorized data modification. As a temporary workaround, consider restricting access to the cf7cs action callback function to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-12341

Affected Products

Custom Skins Contact Form 7

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-12341 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1cee249d-0a0e-4675-9e35-3a177a3b74a2?source=cve · Note
• https://t.me/cvedetector/12688 · Telegram Post
• https://twitter.com/CVEnew/status/1867171941682909391 · Twitter Post
• https://plugins.trac.wordpress.org/browser/custom-skins-contact-form-7/trunk/custom-skins-contact-form-7.php#L182 · Note