Description

WordPress Plugin Redirection for Contact Form 7 is prone to multiple vulnerabilities, including security bypass and PHP object injection vulnerabilities. Exploiting these issues may allow attackers to perform otherwise restricted actions and subsequently generate arbitrary nonces, install arbitrary plugins, delete arbitrary posts, or to execute arbitrary PHP code within the context of the affected webserver process. WordPress Plugin Redirection for Contact Form 7 version 2.3.3 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.3.4 or latest

References

https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/

https://plugins.svn.wordpress.org/wpcf7-redirect/trunk/readme.txt

Related Vulnerabilities

Ruby Numeric Errors Vulnerability (CVE-2008-2662)

WordPress Plugin Qyrr-simply and modern QR-Code creation Cross-Site Scripting (0.6)

WordPress Plugin CSS Plus Multiple Unspecified Vulnerabilities (1.3.1)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-1130)

YetiForce CRM Improper Input Validation Vulnerability (CVE-2021-4111)

Severity

High

Classification

CVE-2021-24278 CVE-2021-24279 CVE-2021-24280 CVE-2021-24281 CVE-2021-24282 CWE-264 CWE-915 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update