CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks. Integration for Contact Form 7 and Constant Contact.This issue affects Integration for Contact Form 7 and Constant Contact: from n/a through 1.1.5.
Explanation of Vulnerability in Simple Terms
The Integration for Contact Form 7 and Constant Contact plugin contains a cross-site request forgery (CSRF) vulnerability in versions up to 1.1.5. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction but can modify site data or settings.
What an attacker can do
Trick a logged-in admin into performing unwanted actions on the site via a malicious webpage.
Potential impact on your site
Attackers can modify plugin settings or data if they trick your admin into visiting a malicious link.
Conditions required to exploit
Admin must visit attacker's webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
