Description

Marc-Alexandre Montpas reported a security issue in the popular WordPress plugin Custom Contact Forms that would allow a user with no administrative privileges to download and modify your database remotely (no authentication required).

Remediation

Upgrade to the latest version of Custom Contact Forms (this problem was fixed in version 5.1.0.4).

References

Critical Vulnerability Disclosed on WordPress Custom Contact Forms Plugin

Related Vulnerabilities

Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-20411)

MediaWiki Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2023-45369)

WordPress Plugin Affiliates Manager Unspecified Vulnerability (2.7.7)

Jenkins Deserialization of Untrusted Data Vulnerability (CVE-2021-21604)

WebLogic CVE-2018-2625 Vulnerability (CVE-2018-2625)

Severity

High

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Missing Update Authentication Bypass