Message Filter for Contact Form 7 <= 1.6.3.8 - Reflected Cross-Site Scripting
Description
The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.6.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NTechnical Details
<=1.6.3.8What Changed in the Fix
Changes introduced in v1.6.3.9
Source Code
WordPress.org SVN## 1. Vulnerability Summary The **Message Filter for Contact Form 7** plugin (versions <= 1.6.3.8) is vulnerable to **Reflected Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin fails to sanitize or escape user-supplied input from URL parameters before echoing it back into th…
Show full research plan
1. Vulnerability Summary
The Message Filter for Contact Form 7 plugin (versions <= 1.6.3.8) is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability exists because the plugin fails to sanitize or escape user-supplied input from URL parameters before echoing it back into the HTML of the administrative dashboard. Specifically, the KMCF7ErrorNotice function in cf7-message-filter.php is registered to the admin_notices hook and explicitly echoes its first argument without any neutralization. If any plugin logic or common admin patterns reflect a $_GET parameter (like tab, page, or message) through this notice system or within the settings page views, an attacker can execute arbitrary JavaScript in the context of an authenticated administrator.
2. Attack Vector Analysis
- Endpoint:
wp-admin/admin.php - Vulnerable Page: The settings pages registered by the plugin, specifically
page=kmcf7-message-filter-optionsor the main pagepage=kmcf7-message-filter. - Vulnerable Parameter:
tab(highly likely based onKMCFMessageFilter.phpline 185) ormessage. - Authentication: Requires Administrator privileges to trigger the payload execution (as it occurs in the admin area), but the attack is unauthenticated in the sense that an attacker can generate and send the malicious link to a victim without needing
Summary
The Message Filter for Contact Form 7 plugin is vulnerable to Reflected Cross-Site Scripting (XSS) due to the failure to properly sanitize and escape input passed to the KMCF7ErrorNotice function. An unauthenticated attacker can execute arbitrary JavaScript in the context of an administrator's browser by tricking them into clicking a link with a malicious payload that is reflected in the administrative dashboard.
Vulnerable Code
/* cf7-message-filter.php lines 97-105 */ function KMCF7ErrorNotice( $message = '' ) { if ( trim( $message ) != '' ) { ?> <div class="error notice is-dismissible"> <p><b>CF7 Message Filter: </b><?php echo $message; ?></p> </div> <?php } }
Security Fix
@@ -9,7 +9,7 @@ * Plugin Name: Message Filter for Contact Form 7 * Plugin URI: https://github.com/kofimokome/cf7-message-filter * Description: Filters messages submitted from contact form 7 if it has words or email marked as spam by the user - * Version: 1.6.3.8 + * Version: 1.6.3.9 * Author: Kofi Mokome * Author URI: https://www.kofimokome.stream * License: GPL-2.0+ @@ -100,7 +100,7 @@ <div class="error notice is-dismissible"> <p><b>CF7 Message Filter: </b><?php - echo $message; + echo wp_kses_post( $message ); ?></p> </div> <?php
Exploit Outline
1. The attacker identifies that the KMCF7ErrorNotice function in cf7-message-filter.php echoes its input directly into the HTML of the admin dashboard without neutralization. 2. The attacker crafts a URL targeting a plugin administrative page (e.g., wp-admin/admin.php?page=kmcf7-message-filter) that includes a malicious JavaScript payload in a parameter likely to be reflected via notices (such as 'message' or 'tab'). 3. The attacker tricks an authenticated administrator into clicking the crafted malicious link using social engineering. 4. When the administrator visits the link, the WordPress 'admin_notices' hook triggers the KMCF7ErrorNotice function, which renders the unescaped script payload into the administrative interface, executing it in the victim's session context.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.