Integrate Contact Form 7 And Aweber Vulnerabilities

[en] The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_aweber_logreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with Subscriber-level access...

Affected:

up to 0.1.43

Fixed in:

0.1.43

Disclosed:

Nov 8, 2025

CVE-2025-12167 on NVD →

The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_aweber_logreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVSS:

4.3

Affected:

up to 0.1.42

Fixed in:

0.1.43

Disclosed:

Nov 7, 2025

CVE-2025-12167 on NVD →

[en] Missing Authorization vulnerability in Renzo Contact Form 7 AWeber Extension allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Contact Form 7 AWeber Extension: from n/a through 0.1.38.

Affected:

up to 0.1.38

Fix:

No patched version reported

Disclosed:

Jun 20, 2025

CVE-2025-49988 on NVD →

The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 0.1.42. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 0.1.42

Fixed in:

0.1.43

Disclosed:

Jun 19, 2025

CVE-2025-49988 on NVD →