WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.6%
exploitation probability
0.6%top 54% of all CVEs
observed exploitation
nono source reports it
In short
The Redirection for Contact Form 7 WordPress plugin fails to properly check user permissions, allowing unauthorized users to access or modify redirect settings that should be restricted. This can let attackers change where form submissions are sent or access sensitive configuration.
Technical detail
Missing authorization checks in the plugin's access control mechanism allow unauthenticated or low-privileged users to exploit improperly configured security levels and access/modify redirection functionality. An attacker without proper permissions can manipulate form redirect endpoints through direct API or interface access, potentially compromising data flow and user experience.
Summary generated and translated by AI from the official description.
Missing Authorization vulnerability in Themeisle Redirection for Contact Form 7 wpcf7-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirection for Contact Form 7: from n/a through <= 2.9.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Themeisle · Redirection for Contact Form 7