CVE-2024-3723 Advanced Contact form 7 DB <= 2.0.2 - Sensitive Information Exposure
Unauthenticated attackers can extract sensitive data uploaded via forms due to insecure storage in the Advanced Contact form 7 DB plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3723?
CVE-2024-3723 is a medium-severity vulnerability in vsourz1td Advanced Contact form 7 DB, published on 11 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-content/uploads/advanced-cf7-upload directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.
Weakness: CWE-922
Which versions are affected by CVE-2024-3723?
How do I fix CVE-2024-3723?
No fix has been published for CVE-2024-3723 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-3723 being exploited?
There is no known exploitation of CVE-2024-3723 in the wild and no public exploit code.
Sources
Also known as GHSA-58cj-373v-pc84.