CVE-2021-24790

Katalog CVE

CVSS 4.3 · Medium EPSS 0,38%

Kerentanan Missing Authorization pada contact form advanced database project contact form advanced database. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.

Rincian

Terbit di NVD

13 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization
CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/adc5dd9b-0781-4cea-8cc5-2c10ac35b968 exploit · advisory pihak ketiga