CVE-2021-24905 Advanced Contact form 7 DB < 1.8.7 - Subscriber+ Arbitrary File Deletion
Authenticated users can delete arbitrary files due to missing authorization and CSRF checks, potentially leading to privilege escalation and code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24905?
CVE-2021-24905 is a high-severity missing authorization vulnerability in Unknown Advanced Contact form 7 DB, published on 21 Mar 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.
Which versions are affected by CVE-2021-24905?
It affects 1 product.
Products include Vsourz Advanced Cf7 Db.
How do I fix CVE-2021-24905?
No fix has been published for CVE-2021-24905 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-24905 being exploited?
There is no known exploitation of CVE-2021-24905 in the wild and no public exploit code.
Other vulnerabilities in Unknown Advanced Contact form 7 DB
Sources
Also known as GHSA-mjq7-mv4f-72x7.