CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept PayPal Payments using Contact Form 7: from n/a through <= 4.0.4.
Explanation of Vulnerability in Simple Terms
The Accept PayPal Payments using Contact Form 7 plugin for WordPress does not properly check user permissions before allowing certain actions. An attacker without authentication can modify data through the plugin's interface. This affects versions 4.0.4 and earlier. Site owners should update to a version newer than 4.0.4 as soon as a patch is available.
What an attacker can do
Modify plugin data or settings without logging in to the site.
Potential impact on your site
Attackers can alter payment settings, form configurations, or stored data without permission.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
