CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
What the vulnerability does
The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcf_validate_form' AJAX endpoint allowing a user controlled parameter to set the 'from' email address. This makes it possible for unauthenticated attackers to send emails to arbitrary recipients utilizing the server. The information is limited to the contact form submission details.
Explanation of Vulnerability in Simple Terms
Quick Contact Form versions 8.2.6 and earlier contain an input validation flaw that allows attackers to modify data integrity without authentication. The vulnerability affects the scope beyond the vulnerable component itself. No confidentiality or availability impact occurs, but attackers can alter information processed by the form.
What an attacker can do
Modify or corrupt data processed by the contact form without needing to log in.
Potential impact on your site
Form submissions may be altered or corrupted, potentially affecting data accuracy and user communications.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
