CVE-2023-39920: high-severity vulnerability in Themeisle Redirection for Contact Form 7
WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The Redirection for Contact Form 7 WordPress plugin fails to properly check user permissions, allowing unauthorized users to access or modify redirect settings that should be restricted. This can let attackers change where form submissions are sent or access sensitive configuration.
Missing authorization checks in the plugin's access control mechanism allow unauthenticated or low-privileged users to exploit improperly configured security levels and access/modify redirection functionality. An attacker without proper permissions can manipulate form redirect endpoints through direct API or interface access, potentially compromising data flow and user experience.
In the same product, most dangerous first.