CVE-2023-23990

Redirection for Contact Form 7 <= 2.7.0 - Authenticated(Editor+) Privilege Escalation

highIncorrect Privilege Assignment
7.2
CVSS Score
7.2
CVSS Score
high
Severity
2.8.0
Patched in
351d
Time to patch

Description

The Redirection for Contact Form 7 plugin is vulnerable to Authenticated Privilege Escalation in versions up to, and including, 2.7.0 due to the ability to update usermeta information. This allows authenticated attackers with Editor-level permissions and above to modify their permissions and grant themselves administrator privileges.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
High
Confidentiality
High
Integrity
High
Availability

Technical Details

Affected versions<=2.7.0
PublishedFebruary 6, 2023
Last updatedJanuary 22, 2024
Affected pluginwpcf7-redirect

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.