Vulnerability Details CVE-2021-24278
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.352
EPSS Ranking 96.9%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- https://wpscan.com/vulnerability/99f30604-d62b-4e30-afcd-b482f8d66413
- https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/
- https://wpscan.com/vulnerability/99f30604-d62b-4e30-afcd-b482f8d66413
- https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/
Products affected by CVE-2021-24278
-
cpe:2.3:a:querysol:redirection_for_contact_form_7:*