CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conditional Fields for Contact Form 7: from n/a through <= 2.4.1.
Explanation of Vulnerability in Simple Terms
Conditional Fields for Contact Form 7 through version 2.4.1 does not properly check user permissions before allowing modifications to form field settings. A logged-in user with low privileges can alter conditional field configurations on contact forms, potentially changing form behavior or exposing unintended fields to site visitors.
What an attacker can do
Modify conditional field settings on contact forms without proper authorization.
Potential impact on your site
Form behavior may be altered unexpectedly; sensitive fields could become visible to unintended audiences.
Conditions required to exploit
Attacker must be logged in with a low-privilege account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
