CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Brian S. Reed Contact Form 7 reCAPTCHA contact-form-7-recaptcha allows Cross Site Request Forgery.This issue affects Contact Form 7 reCAPTCHA: from n/a through <= 1.2.0.
Explanation of Vulnerability in Simple Terms
Contact Form 7 reCAPTCHA versions 1.2.0 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires the admin to visit the attacker's page while logged into WordPress. This can lead to unauthorized changes to form settings or reCAPTCHA configuration.
What an attacker can do
Trick a logged-in admin into performing unwanted actions on the site via a malicious webpage.
Potential impact on your site
Attackers can modify Contact Form 7 reCAPTCHA settings or form configuration without your permission.
Conditions required to exploit
Admin must visit attacker-controlled webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
