CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server. If 'allow_url_fopen' is set to 'On', it is possible to upload a remote file to the server.
Explanation of Vulnerability in Simple Terms
The Redirection for Contact Form 7 plugin for WordPress contains an unrestricted file upload vulnerability in versions up to 3.2.7. An attacker can upload arbitrary files to the server without proper validation, potentially allowing them to execute code or compromise the site. The vulnerability requires specific attack conditions but can result in full site compromise.
What an attacker can do
Upload arbitrary files to the server and potentially execute code on the site.
Potential impact on your site
An attacker could upload malicious files, execute PHP code, steal data, or take full control of your WordPress site.
Conditions required to exploit
Network access to the site; no authentication or user interaction required, but attack complexity is high.
Key dates
External resources
