CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Renzo Johnson Contact Form 7 Campaign Monitor Extension contact-form-7-campaign-monitor-extension.This issue affects Contact Form 7 Campaign Monitor Extension: from n/a through <= 0.4.67.
Explanation of Vulnerability in Simple Terms
The Contact Form 7 Campaign Monitor Extension does not properly check user permissions before allowing certain actions. An attacker without authentication can modify data on the site by sending a direct request. The vulnerability affects all versions up to 0.4.67. Site administrators should update to a version newer than 0.4.67 as soon as possible.
What an attacker can do
Modify site data without logging in or having any user account.
Potential impact on your site
Unauthorized changes to contact form data or campaign monitor settings without any user authentication.
Conditions required to exploit
None. The attacker needs only network access to the site.
Key dates
External resources
Related vulnerabilities
