PT-2024-36843 · WordPress · Cf7 Google Sheets Connector

1337_Wannabe

+1

·

Published

2024-06-08

·

Updated

2024-11-01

·

CVE-2024-5654

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions CF7 Google Sheets Connector plugin for WordPress versions up to, and including, 5.0.9
Description The issue is related to a missing capability check on the execute post data cg7 free function, allowing unauthenticated attackers to modify data. This makes it possible for attackers to toggle site configuration settings, including WP DEBUG, WP DEBUG LOG, SCRIPT DEBUG, and SAVEQUERIES.
Recommendations For CF7 Google Sheets Connector plugin for WordPress versions up to, and including, 5.0.9, update to a version higher than 5.0.9 to resolve the issue. As a temporary workaround, consider disabling the execute post data cg7 free function until a patch is available. Restrict access to site configuration settings to minimize the risk of exploitation. Avoid using the vulnerable function in unauthenticated contexts until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-5654

Affected Products

Cf7 Google Sheets Connector