123Contactform For Wordpress Vulnerabilities

The 123ContactForm for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cfp_upload_image function in versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which ma...

CVSS:

9.8

Affected:

up to 1.5.6

Fix:

No patched version reported

Disclosed:

Jan 20, 2021

The 123ContactForm for WordPress plugin for WordPress is vulnerable to Arbitrary Post Creation in versions up to, and including, 1.5.6. This is due to incorrect signature validation on the cfp_new_post function. This makes it possible for unauthenticated attackers to create arbitrary posts.

CVSS:

7.5

Affected:

up to 1.5.6

Fix:

No patched version reported

Disclosed:

Jan 20, 2021

The 123ContactForm plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the cfp_connect() function in versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to trigger validation and inject their own public SSL key.

CVSS:

9.8

Affected:

up to 1.5.6

Fix:

No patched version reported

Disclosed:

Jan 19, 2021