CVE-2021-24790
Description
The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| contact_form_advanced_database_project contact_form_advanced_database | v ≤ 1.0.8 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.