// For flags

CVE-2021-36913

Redirection for Contact Form 7 <= 2.4.0 - Unauthenticated Options Change and Content Injection vulnerability

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension (plugin) AccessiBe.

Una vulnerabilidad de cambio de opciones sin autenticación e inyección de contenido en el plugin Qube One Redirection for Contact Form 7 versiones anteriores a 2.4.0 incluyéndola en WordPress, permite a atacantes cambiar opciones e inyectar scripts en el HTML del pie de página. Requiere una extensión adicional (plugin) AccessiBe

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on an unknown function in versions up to, and including, 2.4.0. This makes it possible for unauthenticated attackers to update the plugin's options.

*Credits: Vulnerability discovered by John Castro aka mirphak (Patchstack Alliance)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-07-19 CVE Reserved
  • 2022-09-29 CVE Published
  • 2024-04-21 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-284: Improper Access Control
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Redirection-for-contact-form7
Search vendor "Redirection-for-contact-form7"
 Redirection For Contact Form 7
Search vendor "Redirection-for-contact-form7" for product "Redirection For Contact Form 7"
 < 2.6.0
Search vendor "Redirection-for-contact-form7" for product "Redirection For Contact Form 7" and version " < 2.6.0"
wordpress
Affected