// For flags

CVE-2021-24905

Advanced Contact form 7 DB < 1.8.7 - Subscriber+ Arbitrary File Deletion

Severity Score

8.0
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.

El plugin Advanced Contact form 7 DB de WordPress versiones anteriores a 1.8.7, no presenta comprobaciones de autorización ni de tipo CSRF en la acción AJAX acf7_db_edit_scr_file_delete, y no valida el archivo a eliminar, permitiendo a cualquier usuario autenticado eliminar archivos arbitrarios en el servidor web. Por ejemplo, eliminar el archivo wp-config.php permite a atacantes volver a desencadenar la configuración de WordPress, alcanzar privilegios de administrador y ejecutar código arbitrario o mostrar contenido arbitrario a usuarios

*Credits: Krzysztof Zając
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-01-14 CVE Reserved
  • 2022-02-22 CVE Published
  • 2023-10-12 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vsourz
Search vendor "Vsourz"
 Advanced Cf7 Db
Search vendor "Vsourz" for product "Advanced Cf7 Db"
 < 1.8.7
Search vendor "Vsourz" for product "Advanced Cf7 Db" and version " < 1.8.7"
wordpress
Affected