Jquery Validation For Contact Form 7 <= 5.2 - Cross-Site Request Forgery to Arbitrary Options Update
highThe Jquery Validation For Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.2. This is due to missing or incorrect nonce validation on the jvcf7 page. This makes it possible for unauthenticated attackers to update arbitrary options, such as default role...
- CVSS:
- 8.8
- Affected:
- up to 5.2
- Fixed in:
- 5.3
- Disclosed:
- Jun 27, 2022